Promiscuous mode

[lulu]

When I'm running chkrootkit it always gives me a warning saying that my network interface eth0 is in promiscuous mode. What does it mean, and do I have to worry about it?

[joe]

It means that your interface is set to sniff packets from other people. Do you have snort running? That'll put it in promisc mode.

[peter]

I found the following definition on http://searchsecurity.techtarget.com...518283,00.html:

1) In a network, promiscuous mode allows a network device to intercept and read each network packet that arrives in its entirety. This mode of operation is sometimes given to a network snoop server that captures and saves all packets for analysis (for example, for monitoring network usage).

2) In an Ethernet local area network (LAN), promiscuous mode is a mode of operation in which every data packet transmitted can be received and read by a network adapter. Promiscuous mode must be supported by each network adapter as well as by the input/output driver in the host operating system. Promiscuous mode is often used to monitor network activity.

Promiscuous mode is the opposite of non-promiscuous mode. When a data packet is transmitted in non-promiscuous mode, all the LAN devices "listen to" the data to determine if the network address included in the data packet is theirs. If it isn't, the data packet is passed onto the next LAN device until the device with the correct network address is reached. That device then receives and reads the data.

Peter