Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I use iptables to block different kind of attacks on my server. We have a different set of rules along with different rate-limit rules. Now I also use a script that would observe the threshold if it were greater than 10mb/s and dump all the packets to a file. This script keeps running all the time in a screen session and uses the following command to dump:

tcpdump -nn -s0 -c 2000 -w Attack.cap
sleep 300

Once attacked, it waits 5 minutes to check for another attack (sleep 300). Now I doubt if during the packets capture process, iptables still work because in /var/messages I see lines like "eth0 entered promiscuous mode" and "eth0 left promiscuous mode" so it might over-look iptables?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

http://en.wikipedia.org/wiki/Promiscuous_mode

In computer networking, promiscuous mode or promisc mode is a mode for a wired network interface controller (NIC) or wireless network interface controller (WNIC) that causes the controller to pass all traffic it receives to the central processing unit (CPU) rather than passing only the frames that the controller is intended to receive.

This does not bypass any kind of firewall.

share|improve this answer
    
Thank you. That helped. –  Asad Moeen Aug 18 '13 at 18:47

Try using the command

 tcpdump -i eth0 -p  nn -s0 -c 2000 -w Attack.cap

By default tcpdump will put the interface into promiscuous mode. For your purposes, I don't believe you need promiscuous mode for what you are doing. Specifying the inteface prevents tcpdump from looking for it, and possibly getting the wrong interface.

tcpdump grabs the raw packets before they get firewalled by iptables, so you will be able to see packets that get dropped or rejected by the firewall.

share|improve this answer
    
I'm already seeing packets that get dropped by the Firewall so I don't think "promiscious mode" has anything to do there. The only reason why I asked it was because I doubted the firewall not to work because my server made a response to incoming packet but later I realize that the attack maybe passed the filter rules. –  Asad Moeen Aug 19 '13 at 12:54
    
@AsadMoeen Promiscuous mode can increase the load on your network stack by disabling the Ethernet card's on-board filtering. This depends on the network traffic and the boards capabilities. –  BillThor Aug 20 '13 at 1:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.