[26318] in bugtraq
Re: Interface promiscuity obscurity in Linux
daemon@ATHENA.MIT.EDU (Paul Starzetz)
Thu Jul 25 13:11:47 2002
Message-ID: <3D3FC73D.4080100@starzetz.de>
Date: Thu, 25 Jul 2002 11:39:09 +0200
From: Paul Starzetz <paul@starzetz.de>
MIME-Version: 1.0
To: Ricardo Branco <97-29312@ldc.usb.ve>, bugtraq@securityfocus.com
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Ricardo Branco wrote:
>This affects Linux 2.2 and 2.4
>
>Using libpcap to put the interface in promiscuous mode, will cause that
>ifconfig(8) doesn't show it!
>
>
This is an old issue (noticed this nearly 2 years ago...) but can be
contributed to 'bad' userspace tools.
>libpcap uses setsockopt(..., SOL_PACKET, PACKET_ADD_MEMBERSHIP, ...) with
>PACKET_MR_PROMISC to set the interface in promiscuous mode.
>
>
The interesting thing is that the PF_PACKET sockets are also not
reported by netstat. Anyway this should be fixed.
/ih
