tcpdump and promiscuous mode (on Linux and HP-UX)

Thread Tools Search this Thread
Special Forums IP Networking tcpdump and promiscuous mode (on Linux and HP-UX)
# 1  
Old 02-25-2008
tcpdump and promiscuous mode (on Linux and HP-UX)


I want to use tcpdump to analyze the NTP traffic on some of my machines. The machines that I want to analyze run HP-UX and linux. To use tcpdump 2 packages are required Libpcap and Tcpdump. I know that tcpdump (libcap?) sets the network interface to promiscuous mode. I have some questions:

1) does the installation itself of libcap/tcpdump set the interface to promiscuous mode mode or does tcpdump set the interface to promiscuous mode when it is started and then it sets back to non promiscuous mode when it is stopped?

2) If the promiscuous mode is activated at installation time, how to deactivate it when I am ready with my analysis? Is it enough to de-install the 2 packages?

3) How to check if the promiscuous mode is activated without installing extra packages? (I do not see anything in the logs (at least on HP-UX) and nothing with dmesg)

4) which are the drawbacks with an active promiscuous mode? I guess higher latency time (?), what about security?, what else?

Most important for me is what happens with the HP-UX machines.

Thanks a lot.
# 2  
Old 02-28-2008
It switches modes when it's run, rather than at install time
The main effect of running in this mode is an increase in network traffic through the card (it's likely to cause a small increase in CPU load too).
If you completely overwhelm the card, you could potentially start dropping packets, inbcluding ones genuinly destined for this server - not very likely to happen with modern hardware though.

No major security concerns but one could make the case that accepting more data in over the NIC increases one's exposure to potential threats. Not exactly a biggie though Smilie
Login or Register to Ask a Question

Previous Thread | Next Thread

5 More Discussions You Might Find Interesting

1. Red Hat

Interface goes into promiscuous mode

Hi all, I am using a Linux VM. Once the node boots up, I am able to access it and it is able to ping its default gateway. At that time, the config is; eth1 Link encap:Ethernet HWaddr 00:50:56:01:01:FB inet addr: Bcast: ... (1 Reply)
Discussion started by: Junaid Subhani
1 Replies

2. UNIX for Dummies Questions & Answers

Will Linux force NIC into promiscuous mode?

Right now I have a computer that I want to use as the monitor for my network. It's currently running Windows 7, and so as I understand it the NIC won't monitor all the traffic on the network. So my question is, if I install Linux on this computer will I be able to force the NIC card into... (1 Reply)
Discussion started by: iJeydon
1 Replies

3. AIX

promiscuous mode AIX

Hi Guys, What do I need to do to set an physical adapter to promiscuous mode? The networkport is already spanned/mirrored. Is this also possible when there is an virtual nic (through vios) configured? regards, Randy (7 Replies)
Discussion started by: raba
7 Replies

4. SuSE

Convet Linux OS from text mode to graphic mode

Hi All, I used to have my suse linux(VM) server in graphic mode but not anymore since morning. I cant rolback since i loose somuch work. Any idea how to it back to normal. Thanks (6 Replies)
Discussion started by: s_linux
6 Replies

5. IP Networking

promiscuous mode machines

/* SCO OpenServer 5 */ anyone know an effective way to tell what machines, if any, are running in promiscuous mode?? e0- (1 Reply)
Discussion started by: LowOrderBit
1 Replies
Login or Register to Ask a Question