The difference is trivial... Normally, the NIC checks the destination ethernet frame for broadcast or it's own MAC address and processes only those - at the hardware level.
Setting promisc means that the hardware processes all frames and passes them into the stack. Tools like libpcap which hook at that level can then see all frames. But the stack implements the same type of 'is it for me' tests before passing frames to higher levels (e.g. tcp/ip, applications, etc.). -----Burton -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Niels Sent: Monday, April 04, 2005 1:54 PM To: [email protected] Subject: [Ntop] RE: Promisc mode dangerous? Burton Strauss wrote: > Nope. Smurf has nothing to do with ntop, since except in reply to web > requests, ntop doesn't send anything. So worry about smurf and a > compromised box, not ntop... Right. So this means that a computer somewhere is compromised somehow and is smurfing other machines. And it's more or less impossible to tell which machine is the culprit, right? > In fact it's absolutely necessary for ntop to place interfaces in > promiscuous mode (just like snort, etc.) - otherwise ntop doesn't see > all the traffic. Read docs/FAQ. Yes, I get it. But still. Putting ethx in promisc means that it reads all packages passing by. Does that leave the machine more vulnerable? Does it change the traffic in any way? Should I only poll one interface, given my configuration? Thank you for your quick answer! //Niels _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
