Under Linux (at least), promiscuous mode is a bit of a lie. Whether it's set at the hardware level depends upon the driver and the configuration ...
ifconfig doesn't report from the hardware, it uses the dev->flags value. But the actual hardware could be. For example, some chips only allow one or two IP addresses for the device. If there are more, the driver puts the device into promiscuous mode w/o setting the kernel flag. Thus the ifconfig doesn't report it as promiscuous mode, but it is - sort of. Programs like ntop which use libpcap to hook to the device driver see the packets. One that I know does this is the via-rhine driver (because this just came up @ ExpertsExchange). -----Burton -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Farhan Ali Khan Sent: Saturday, February 12, 2005 5:07 PM To: [email protected]; [EMAIL PROTECTED] Subject: Re: [Ntop-dev] TCP Sessions Hi, The ifconfig doesnt seem to be reporting interfaces in promisc mode correctly, atleast for ntop, I checked this at two places (one of them displays sessions ok). I ran NTOP and then ifconfig, and it dint show interfaces in promisc mode. NTOP was still catching *all* traffic because I could see the hosts adding in the hosts table and ftp data column being incremented except for the fact that the session wasnt being shown, so i concluded that NIC was actually in promisc mode and ifconfig may not be reporting correctly, but to be sure I set the interfaces to promisc mode using "ifconfig eth0 promisc" & "ifconfig eth1 promisc", and then it shows them in PROMISC mode forever, without any impact on the running of NTOP (i.e. sessions still not display). What could be wrong here? Thanks Regards Farhan Ali Khan <snip /> _______________________________________________ Ntop-dev mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-dev
