Re: [Full-disclosure] Promiscious Device Detection

Hi,

Q Beukes wrote:

I am looking for linux utility that checks if a specified machine's
network device is in promiscious mode or not.

Technically, promiscuous mode only affects packet reception, so it is pretty difficult to detect; however most packet sniffers will not hide the packets that would have been filtered normally from the kernel, so the kernel should react to e.g. a ping or SYN packet that has the correct destination IP address for that host, but would normally be filtered by the MAC (e.g. with a different destination MAC address).

I don't have a readymade utility for that (I'd code it if need arises, but the days of Cheapernet are gone), but you can test from the shell by creating a static ARP entry using the arp(8) tool and then pinging the IP.

Simon
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Relevant Pages

  • Re: [Full-disclosure] Promiscious Device Detection
    ... Technically, promiscuous mode only affects packet reception, so it is ... the packets that would have been filtered normally from the kernel, ... correct destination IP address for that host, ... filtered by the MAC (e.g. with a different destination MAC address). ...
    (Full-Disclosure)
  • Re: bandwidth and multiple NICs
    ... ng_fec looks at the destination mac addresses to work out which NIC ... for that decision -- but that means the packet has to be an IP packet. ... useful to you it would have to hash on TCP port numbers instead. ... of consecutive TCP connections and not enough parallel ones. ...
    (comp.unix.bsd.freebsd.misc)
  • Re: Promiscuous Mode
    ... packet with an IP matching its own if the destination MAC in the packet ... paragraph in the previous mail, ... what do network stacks (not NICs) typically do? ...
    (Pen-Test)
  • RE: Question on SOCK_RAW, implement a bpf->other host tee
    ... > another layer-2 adjacent host. ... it appears the packet does ... but the destination MAC is ... I can capture it on the correct output interface ...
    (freebsd-net)