I read that seeing a flag of M in netstat -i is the way to tell which of your interfaces is in promiscuous mode

I run it and I see that eth1 is in promiscuous mode

$ netstat -i
Kernel Interface table
eth1       1500   0 1770161198      0      0      0 57446481      0      0      0 BMRU
lo        16436   0 97501566      0      0      0 97501566      0      0      0 LRU

This seems to be the case on all the machines I checked (All Centos6.0, both virtual and physical), any idea why ethernet devices would be in such a mode unless someone was running any pcap based app (sudo lsof | grep pcap shows nothing)?

I did not see any mention of promiscuous in any of the config files (sudo grep -r promis /etc)

Any ideas what puts the interface into that mode and why?

p.s. most of the posts I see seem to be security related, this is not that

EDIT: Just an observation, I noticed that the kernel logs when the interfaces enter and exit promisc mode (specifically seeing the logs with tcpdump when the -p flag is not specified and not seeing them with that option). This helps to confirm (for me) the accepted answer.

Dec  5 11:12:23 XXXX kernel: device eth1 entered promiscuous mode
Dec  5 11:12:29 XXXX kernel: device eth1 left promiscuous mode

M is multicast:

# netstat -i | grep ^lo
lo        16436 0    588800      0      0 0        588800      0      0      0 LRU
# ifconfig lo multicast
# netstat -i | grep ^lo
lo        16436 0    588800      0      0 0        588800      0      0      0 LMRU

P is promiscuous:

# ifconfig lo promisc
# netstat -i | grep ^lo
lo        16436 0    588880      0      0 0        588880      0      0      0 LPRU
  • so this is wrong? ibm.com/developerworks/mydeveloperworks/blogs/… – nhed Nov 28 '12 at 22:47
  • @nhed definitely and makes no sense. – h0tw1r3 Nov 28 '12 at 22:51
  • ok, so I went and ran tcpdump without specifying -p and did not see a P on netstat -i Wouldn't pcap put it in promisc mode? – nhed Nov 28 '12 at 22:55
  • here is another one of the reading material that misdirected towards the M flag (oh google how you failed me :) tots.1o24.org/…) – nhed Nov 28 '12 at 22:56
  • 2
    tcpdump man pages suggest it goes into promisc mode UNLESS you tell it not to with -p. Side note, the inaccuracy of that blog, on ibm.com no less, is ridiculous. – USD Matt Dec 5 '12 at 16:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.