If you watch the start up you will normally see a message when your nic
is switched to promiscuous mode. Other than that, check in
'/var/log/messages' to see what actually occurred when your machine was
last started.
Seeing that you do not say you are running a sniffer, which I'm sure
you'd know because that would be a deliberate addition on your part, I
would suspect 'arpwatch' as a potential client. If you don't have any
need for mapping mac addresses to ip addresses on your net work you can
turn 'arpwatch' off.
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Robert J Bartels
Sent: May 2, 2000 12:16 PM
To: [EMAIL PROTECTED]
Subject: [expert] promiscuous mode
I've been getting this security warning for the past few weeks.
May 2 11:03:01 charm : Security warning : eth0 is in promiscuous mode.
May 2 11:03:01 charm : A sniffer is probably running on your
system.
1> How can I tell if eth0 is currently in promiscuous mode?
2> How can I tell what program is making it run in p mode?
3> The network connection for this machine has been messed up..
i.e. While running a ftp server the outbound connections slow down
to
a crawl
every so often... I get disconnected from home while using ssh... Could
this
p mode be causing this??
4> How can I fix this without reloading the whole system??
Thanks a bunch!
Bob
