Hi Bernd,
On 4/6/07, Bernd Eckenfels <[EMAIL PROTECTED]> wrote:
On Fri, Apr 06, 2007 at 08:41:00PM -0300, Martín Ferrari wrote:
> OK, I've read it, but I still don't get three things:
>
> - why ifconfig can set promisc mode and then get it right?
if you set promisc over the old ioctl interface, then it is reported by the
kernel correctly.
Yes, I learned that just now.
> - why iproute does the same as ifconfig, and doesn't work as said in the
> thread?
I think ip does not the same, it uses netdev instead of ioctl. Not sure if
something has changed for ip.
It uses ioctl for setting promisc, but netlink for showing
information. But it doesn't work! (see my mail to net-dev)
ip l show eth0:
socket(PF_NETLINK, SOCK_RAW, 0) = 3
> - what is the interface that should be used to report correctly
> promisc mode when tcpdump is running??
Thats a good question :) I guess a solution would be to export the counter
to userspace (which would most likely be done with netlink or sysfs) and
then print it. I think a short time for for this issue could be to update
the man page (and have a look in root kit detectors, they usually can tell
when the system is in promisc)
I haven't found any one that does detect it.. Have you?
--
Martín Ferrari
