Re: promisc mode with pcap

[Guy Harris <guy () alum mit edu>]

On Thu, Mar 04, 2004 at 11:02:21AM +0100, Krasi Zlatev wrote:
> Can you tell me why when I use older version of pcap,
> for example libpcap-0.5.2,
>
> when doing pcap_open_live(dev, 1500, 1, 1, ebuf),
> ifconfig tells me that the device is running in
> promisc mode,
> but when I use newer version of pcap with the same
> code, ifconfig does not show promisc mode.

Are you running on Linux?

If so, then it's because:

        the older versions of libpcap used SOCK_PACKET sockets - with
        those, the only way to turn promiscuous mode on is to set the
        interface's promiscuous flag, and that's the flag ifconfig
        shows;

        the newer versions use PF_PACKET sockets, on 2.2 and later
        kernels, and with those, there's a better way of turning
        promiscuous mode on and off, but it sets a flag that ifconfig
        *doesn't* show.
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:tcpdump-workers-request () tcpdump org?body=unsubscribe