path: root/README.linux
diff options
authorGuy Harris <guy@alum.mit.edu>2000-02-01 21:52:22 +0000
committerGuy Harris <guy@alum.mit.edu>2000-02-01 21:52:22 +0000
commit9b937a183aa31e7690e3b1b88683240356c07de9 (patch)
treec33c0bdba935e9466154c95575e69c9f4daaa39c /README.linux
parent6e8ab029fc6188ccd4e7a9a24c7413f099e91307 (diff)
Add a note about many Linux libpcaps turning promiscuous mode off only
when the program using libpcap exits, and perhaps not doing so even then, and indicating how to check whether an interface is in promiscuous mode and how to take it out of promiscuous mode if it is in promiscuous mode. svn path=/trunk/; revision=1593
Diffstat (limited to 'README.linux')
1 files changed, 29 insertions, 1 deletions
diff --git a/README.linux b/README.linux
index e754b73..ea6d125 100644
--- a/README.linux
+++ b/README.linux
@@ -1,4 +1,4 @@
-$Id: README.linux,v 1.4 2000/02/01 21:21:47 guy Exp $
+$Id: README.linux,v 1.5 2000/02/01 21:52:22 guy Exp $
The standard libpcap compiled for Linux has a timeout problem; it
doesn't support the timeout argument to "pcap_open_live()".
@@ -19,3 +19,31 @@ you're capturing on a Linux loopback device, do not use a capture
filter, as it will probably reject most if not all packets, including
the packets it's intended to accept - instead, capture all packets and
use a display filter to select the packets you want to see.
+In addition, current versions of libpcap on at least some Linux
+distributions will not turn promiscuous mode off on a network device
+until the program using promiscuous mode exits, so if you start a
+capture with Ethereal on some Linux distributions, the network interface
+will be put in promiscuous mode and will remain in promiscuous mode
+until Ethereal exits. There might be additional libpcap bugs that cause
+it not to be turned off even when Ethereal exits; if your network is
+busy, this could cause the Linux networking stack to do a lot more work
+discarding packets not intended for the machine, so you may want to
+check, after running Ethereal, whether any network interfaces are in
+promiscuous mode (the output of "ifconfig -a" will say something such as
+eth0 Link encap:Ethernet HWaddr 00:00:66:66:66:66
+ inet addr: Bcast: Mask:
+ RX packets:6493 errors:0 dropped:0 overruns:0 frame:0
+ TX packets:3380 errors:0 dropped:0 overruns:0 carrier:0
+ collisions:0 txqueuelen:100
+ Interrupt:18 Base address:0xfc80
+with "PROMISC" indicating that the interface is in promiscuous mode),
+and, if any interfaces are in promiscuous mode and no capture is being
+done on that interface, turn promiscuous mode off by hand with
+ ifconfig <ifname> -promisc
+where "<ifname>" is the name of the interface.