Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I read that seeing a flag of M in netstat -i is the way to tell which of your interfaces is in promiscuous mode

I run it and I see that eth1 is in promiscuous mode

$ netstat -i
Kernel Interface table
eth1       1500   0 1770161198      0      0      0 57446481      0      0      0 BMRU
lo        16436   0 97501566      0      0      0 97501566      0      0      0 LRU

This seems to be the case on all the machines I checked (All Centos6.0, both virtual and physical), any idea why ethernet devices would be in such a mode unless someone was running any pcap based app (sudo lsof | grep pcap shows nothing)?

I did not see any mention of promiscuous in any of the config files (sudo grep -r promis /etc)

Any ideas what puts the interface into that mode and why?

p.s. most of the posts I see seem to be security related, this is not that

EDIT: Just an observation, I noticed that the kernel logs when the interfaces enter and exit promisc mode (specifically seeing the logs with tcpdump when the -p flag is not specified and not seeing them with that option). This helps to confirm (for me) the accepted answer.

Dec  5 11:12:23 XXXX kernel: device eth1 entered promiscuous mode
Dec  5 11:12:29 XXXX kernel: device eth1 left promiscuous mode
share|improve this question
up vote 3 down vote accepted

M is multicast:

# netstat -i | grep ^lo
lo        16436 0    588800      0      0 0        588800      0      0      0 LRU
# ifconfig lo multicast
# netstat -i | grep ^lo
lo        16436 0    588800      0      0 0        588800      0      0      0 LMRU

P is promiscuous:

# ifconfig lo promisc
# netstat -i | grep ^lo
lo        16436 0    588880      0      0 0        588880      0      0      0 LPRU
share|improve this answer
so this is wrong?… – nhed Nov 28 '12 at 22:47
@nhed definitely and makes no sense. – h0tw1r3 Nov 28 '12 at 22:51
ok, so I went and ran tcpdump without specifying -p and did not see a P on netstat -i Wouldn't pcap put it in promisc mode? – nhed Nov 28 '12 at 22:55
here is another one of the reading material that misdirected towards the M flag (oh google how you failed me :)…) – nhed Nov 28 '12 at 22:56
tcpdump man pages suggest it goes into promisc mode UNLESS you tell it not to with -p. Side note, the inaccuracy of that blog, on no less, is ridiculous. – USD Matt Dec 5 '12 at 16:34

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.