[26297] in bugtraq
Interface promiscuity obscurity in Linux
daemon@ATHENA.MIT.EDU (Ricardo Branco)
Wed Jul 24 17:47:30 2002
Date: Thu, 25 Jul 2002 00:20:19 +0400 (GMT)
From: Ricardo Branco <97-29312@ldc.usb.ve>
To: <bugtraq@securityfocus.com>
Message-ID: <Pine.GSO.4.32.0207250011340.5286-100000@korba.ldc.usb.ve>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
This affects Linux 2.2 and 2.4
Using libpcap to put the interface in promiscuous mode, will cause that
ifconfig(8) doesn't show it!
libpcap uses setsockopt(..., SOL_PACKET, PACKET_ADD_MEMBERSHIP, ...) with
PACKET_MR_PROMISC to set the interface in promiscuous mode.
I notified this to the tcpdump-workers mailing list and the problem is
that the setsockopt() sets the promisc flag in a variable that is not the
same as the one that the SIOCGIFFLAGS ioctl() reads. I don't have the
kernel source right now to make this advisory more precise.
Well, sorry for my not-so-good english
Enjoy
