promiscuous mode

[Paul Howarth]

On Tue, 2005-08-23 at 14:33 -0500, Teo Fonrouge wrote:
> Paul Howarth wrote:
> > On Tue, 2005-08-23 at 20:52 +0200, Oliver Leitner wrote:
> > 
> >>-----BEGIN PGP SIGNED MESSAGE-----
> >>Hash: RIPEMD160
> >> 
> >>Teo Fonrouge wrote:
> >>
> >>| Hello,
> >>|
> >>| Using a FC4 box.
> >>|
> >>| Checking in my /var/log/messages file I noticed that the kernel has
> >>|  setting my eth0 interface in promiscuous mode regularly:
> >>|
> >>| Aug 21 14:30:38 sx1 kernel: eth0: Setting promiscuous mode. Aug 21
> >>| 14:30:38 sx1 kernel: device eth0 entered promiscuous mode Aug 21
> >>| 14:30:38 sx1 kernel: bridge-eth0: enabled promiscuous mode Aug 21
> >>| 14:31:36 sx1 kernel: device eth0 left promiscuous mode Aug 21
> >>| 14:31:36 sx1 kernel: bridge-eth0: disabled promiscuous mode Aug 21
> >>| 14:31:36 sx1 kernel: eth0: Setting promiscuous mode. Aug 21
> >>| 14:31:36 sx1 kernel: device eth0 entered promiscuous mode Aug 21
> >>| 14:31:36 sx1 kernel: bridge-eth0: enabled promiscuous mode
> >>|
> >>| I believe that I haven't ran any program that causes this.
> >>|
> >>| It is a normal kernel operation ?
> >>|
> >>| How can I know what is causing this ?
> >>|
> >>|
> >>| best regards
> >>|
> >>| Teo Fonrogue
> >>|
> >>does any of these programs ring a bell?:
> >>
> >>iptraf
> >>tcpdump
> >>ethereal
> >>
> >>or any other monitoring program?
> > 
> > 
> > Or VMware?
> > 
> > Paul.
> 
> Yes.
> 
> VMware is running in this box.
> 
> hmmmmmmmm.
> 
> How do you know that VMware maybe is causing this ?
> 
> About the WinXP Client machine running regularly run on it: of course 
> I'll have to check if this windoze has some virus/spy*/nastythings.

If you're running bridged networking for your VMware guest, it has to
put the interfaces into promiscuous mode so that you can receive packets
for the guest. This is normal.

Paul.
-- 
Paul Howarth <paul at city-fan.org>