Professional Documents
Culture Documents
May 8, 2017
Wikipedia defines promiscuous mode as a mode for a wired network interface controller (NIC)
or wireless network interface controller (WNIC) that causes the controller to pass all traffic it
receives to the central processing unit (CPU)rather than passing only the frames that the
controller is intended to receive.
For a given interface, check the flags to see if the promiscuous bit is set.
$ cat /sys/devices/virtual/net/veth0/flags
0x1303 # 0001 001[1] 0000 0011 # device is in promiscuous mode.
$ cat /sys/devices/virtual/net/br0/flags
0x1003 # 0001 000[0] 0000 0011 # device is not in promiscuous mode.
Heres a quick python script to test promiscuous mode for all interfaces:
# This script goes through all the network devices on the system
# and determines if the device in promiscuous mode.
#
# More information at: http://goyalankit.com/blog/promiscuous-mode-detection
#
# Usage: python is_promiscuous.py
# Author: Ankit Goyal (http://github.com/goyalankit)
import os
NET_DEVICE_PATH = '/sys/devices/virtual/net/'
IFF_PROMISC = 0x100
def print_results(table):
header = [('Device', 'Promisc Mode'), ('------', '---------------')]
table = header + table
col_width = [max(len(x) for x in col) for col in zip(*table)]
for line in table:
print "| " + " | ".join("{0:{1}}".format(x, col_width[i])
for i, x in enumerate(line)) + " |"
def iterate_and_determine_promisc():
device_promisc = []
for device in os.listdir(NET_DEVICE_PATH):
with open(os.path.join(NET_DEVICE_PATH, device, 'flags')) as f:
device_flags = f.read()
if device_flags:
if int(hex(int(device_flags, 16) & IFF_PROMISC), 16):
device_promisc.append((device, 'ON'))
else:
device_promisc.append((device, 'OFF'))
else:
device_promisc.append((device, 'UNKNOWN'))
print_results(device_promisc)
iterate_and_determine_promisc()
view raw is_promiscuous.py hosted with by GitHub
At first glance, youd think iproute2 or netstat -i command should tell you if the device is in
promiscuous mode but thats not always the case.
Well consider two examples here, first to show the case where it works as expected and second
to show where it doesnt.
A word on netstat:
In netstat command, flag P is used to display if the interface is in promiscuous mode. However, P
is also used for point to point connection. You can verify from the net-tools code here
Lets check the kernel log messages, as logged in __dev_set_promiscuity whenever a device is
added/removed to/from promiscuous mode.
It doesnt show the device to be in promiscuous mode as PROMISC is not set and the flag P is not
present in netstat
Lets check kernel logs and see if the device was actually put into promiscuous mode.
As expected, the device was in fact moved to promiscuous mode but iproute2 doesnt show
it in promiscuous mode.
References
1. https://lists.gt.net/linux/kernel/178148