okay and what do you think about my other email regarding the Remote->Remote TCP Sessions and that nonFullyRemoteSession Flag being set to 0 in pbuf.c??
On Sat, 12 Feb 2005 19:40:14 -0600, Burton Strauss <[EMAIL PROTECTED]> wrote: > Under Linux (at least), promiscuous mode is a bit of a lie. Whether it's > set at the hardware level depends upon the driver and the configuration ... > > ifconfig doesn't report from the hardware, it uses the dev->flags value. > But the actual hardware could be. > > For example, some chips only allow one or two IP addresses for the device. > If there are more, the driver puts the device into promiscuous mode w/o > setting the kernel flag. Thus the ifconfig doesn't report it as promiscuous > mode, but it is - sort of. Programs like ntop which use libpcap to hook to > the device driver see the packets. > > One that I know does this is the via-rhine driver (because this just came up > @ ExpertsExchange). > > -----Burton > > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf > Of Farhan Ali Khan > Sent: Saturday, February 12, 2005 5:07 PM > To: [email protected]; [EMAIL PROTECTED] > Subject: Re: [Ntop-dev] TCP Sessions > > Hi, > The ifconfig doesnt seem to be reporting interfaces in promisc mode > correctly, atleast for ntop, I checked this at two places (one of them > displays sessions ok). > I ran NTOP and then ifconfig, and it dint show interfaces in promisc mode. > NTOP was still catching *all* traffic because I could see the hosts adding > in the hosts table and ftp data column being incremented except for the fact > that the session wasnt being shown, so i concluded that NIC was actually in > promisc mode and ifconfig may not be reporting correctly, but to be sure I > set the interfaces to promisc mode using "ifconfig eth0 promisc" & "ifconfig > eth1 promisc", and then it shows them in PROMISC mode forever, without any > impact on the running of NTOP (i.e. sessions still not display). > > What could be wrong here? > > Thanks > Regards > Farhan Ali Khan > > <snip /> > > _______________________________________________ > Ntop-dev mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-dev > _______________________________________________ Ntop-dev mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-dev
