See if your system is logging any cron jobs and the results somewhere.
It may have a clue because this sounds like something that is running on
a regular schedule. Also, maybe look through the files that cron reads
to do it's tasks, i.e. cron.daily or something of that nature and see if
a possible clue resides there. You may have to read some man pages to
determine if one of the side effects of a given function is to throw
your nic into promiscuous mode.
Sorry I'm not of much more help. It's the best next step I could think
of at the moment.
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Robert J Bartels
Sent: May 3, 2000 1:30 PM
To: [EMAIL PROTECTED]
Subject: [expert] promiscuous mode revisited
Ok heres one for the gurus..
Here's what happens...
My server is on a 100MB switched auto sensing port. It has been going
into
promiscuous mode for no reason..
I'm using ifconfig and yes it does list it as promiscuous at times.. .
Normal bandwidth utilization is around 800KB/s. Randomly it just slows
down
to a crawl to around 1.3KB/s of utilization.
This slowdown typically lasts for around 3-5 seconds.
I don't know if the promisc mode is doing this but all I know is that
when
I run ifconfig eth0 after a slowdown it ALWAYS
shows eth0 running in promiscuous mode... After the network utilization
rates go back up to normal running ifconfig shows
that its no longer in promiscuous mode... This happens atleast once an
hour
if not several times an hour.
If I'm using a ssh connection from home when this happens I get dropped.
What is causing this to happen??? My machine has not been hacked (that I
know of at least.. I keep good logs/security..)
The network is saturated but not to the point where it slows down to
1.3KB/s from 800KB/s. This happens even at off usage times..i.e. 3am
I'm not telling the nic to go into promiscuous mode.. and i'm not
telling
it to stop when it say its in that mode..
Warning messages about promiscuous mode go to the screen when the
network
slows...
Please help.. This is truly making my life hell.. and all those people
who
get disconnect from services when the machine slows down...
Thanks all
Bob
p.s.
Mandrake 7.02 Dell Gxa Pentuim III
Embedded dell 3com 10/100 card...
Arpwatch is not running... Just FTPd, HTTPd, NFSd
More info on request
