Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I read that seeing a flag of M in netstat -i is the way to tell which of your interfaces is in promiscuous mode

I run it and I see that eth1 is in promiscuous mode

$ netstat -i
Kernel Interface table
Iface       MTU Met    RX-OK RX-ERR RX-DRP RX-OVR    TX-OK TX-ERR TX-DRP TX-OVR Flg
eth1       1500   0 1770161198      0      0      0 57446481      0      0      0 BMRU
lo        16436   0 97501566      0      0      0 97501566      0      0      0 LRU

This seems to be the case on all the machines I checked (All Centos6.0, both virtual and physical), any idea why ethernet devices would be in such a mode unless someone was running any pcap based app (sudo lsof | grep pcap shows nothing)?

I did not see any mention of promiscuous in any of the config files (sudo grep -r promis /etc)

Any ideas what puts the interface into that mode and why?

p.s. most of the posts I see seem to be security related, this is not that


EDIT: Just an observation, I noticed that the kernel logs when the interfaces enter and exit promisc mode (specifically seeing the logs with tcpdump when the -p flag is not specified and not seeing them with that option). This helps to confirm (for me) the accepted answer.

Dec  5 11:12:23 XXXX kernel: device eth1 entered promiscuous mode
Dec  5 11:12:29 XXXX kernel: device eth1 left promiscuous mode
share|improve this question
add comment

1 Answer 1

up vote 3 down vote accepted

M is multicast:

# netstat -i | grep ^lo
lo        16436 0    588800      0      0 0        588800      0      0      0 LRU
# ifconfig lo multicast
# netstat -i | grep ^lo
lo        16436 0    588800      0      0 0        588800      0      0      0 LMRU

P is promiscuous:

# ifconfig lo promisc
# netstat -i | grep ^lo
lo        16436 0    588880      0      0 0        588880      0      0      0 LPRU
share|improve this answer
    
so this is wrong? ibm.com/developerworks/mydeveloperworks/blogs/… –  nhed Nov 28 '12 at 22:47
    
@nhed definitely and makes no sense. –  h0tw1r3 Nov 28 '12 at 22:51
    
ok, so I went and ran tcpdump without specifying -p and did not see a P on netstat -i Wouldn't pcap put it in promisc mode? –  nhed Nov 28 '12 at 22:55
    
here is another one of the reading material that misdirected towards the M flag (oh google how you failed me :) tots.1o24.org/…) –  nhed Nov 28 '12 at 22:56
    
@nhed see tcpdump.org/faq.html#q7 "the form of promiscuous mode that libpcap (the library that programs such as tcpdump use to do packet capture) turns on will not necessarily be shown if you run ifconfig on the interface on a UNIX system;" –  h0tw1r3 Nov 28 '12 at 22:59
show 7 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.