0

I read that seeing a flag of M in netstat -i is the way to tell which of your interfaces is in promiscuous mode

I run it and I see that eth1 is in promiscuous mode

$ netstat -i
Kernel Interface table
Iface       MTU Met    RX-OK RX-ERR RX-DRP RX-OVR    TX-OK TX-ERR TX-DRP TX-OVR Flg
eth1       1500   0 1770161198      0      0      0 57446481      0      0      0 BMRU
lo        16436   0 97501566      0      0      0 97501566      0      0      0 LRU

This seems to be the case on all the machines I checked (All Centos6.0, both virtual and physical), any idea why ethernet devices would be in such a mode unless someone was running any pcap based app (sudo lsof | grep pcap shows nothing)?

I did not see any mention of promiscuous in any of the config files (sudo grep -r promis /etc)

Any ideas what puts the interface into that mode and why?

p.s. most of the posts I see seem to be security related, this is not that

EDIT: Just an observation, I noticed that the kernel logs when the interfaces enter and exit promisc mode (specifically seeing the logs with tcpdump when the -p flag is not specified and not seeing them with that option). This helps to confirm (for me) the accepted answer.

Dec  5 11:12:23 XXXX kernel: device eth1 entered promiscuous mode
Dec  5 11:12:29 XXXX kernel: device eth1 left promiscuous mode
Improve this question
0

1 Answer 1

Reset to default
3

M is multicast:

# netstat -i | grep ^lo
lo        16436 0    588800      0      0 0        588800      0      0      0 LRU
# ifconfig lo multicast
# netstat -i | grep ^lo
lo        16436 0    588800      0      0 0        588800      0      0      0 LMRU

P is promiscuous:

# ifconfig lo promisc
# netstat -i | grep ^lo
lo        16436 0    588880      0      0 0        588880      0      0      0 LPRU
Improve this answer
12
  • so this is wrong? ibm.com/developerworks/mydeveloperworks/blogs/…
    – nhed
    Nov 28, 2012 at 22:47
  • @nhed definitely and makes no sense.
    – h0tw1r3
    Nov 28, 2012 at 22:51
  • ok, so I went and ran tcpdump without specifying -p and did not see a P on netstat -i Wouldn't pcap put it in promisc mode?
    – nhed
    Nov 28, 2012 at 22:55
  • here is another one of the reading material that misdirected towards the M flag (oh google how you failed me :) tots.1o24.org/…)
    – nhed
    Nov 28, 2012 at 22:56
  • 2
    tcpdump man pages suggest it goes into promisc mode UNLESS you tell it not to with -p. Side note, the inaccuracy of that blog, on ibm.com no less, is ridiculous.
    – USD Matt
    Dec 5, 2012 at 16:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .