Is the network device in promiscuous mode?
May 8, 2017
Wikipedia defines promiscuous mode as a mode for a wired network interface controller (NIC) or wireless network interface controller (WNIC) that causes the controller to pass all traffic it receives to the central processing unit (CPU)rather than passing only the frames that the controller is intended to receive.
How do I tell if a device is in promiscuous mode?
tl;dr: Kernel tracks promiscuous mode using flags on the device. For promiscuous mode, IFF_PROMISC, 0x100 should be set.
For a given interface, check the flags to see if the promiscuous bit is set.
Here’s a quick python script to test promiscuous mode for all interfaces:
Problem with existing tools
Figuring out if a given network device is in promiscuous mode using tools like
netstat can be trickier than you’d think.
At first glance, you’d think
netstat -i command should tell you if the device is in promiscuous mode but that’s not always the case.
We’ll consider two examples here, first to show the case where it works as expected and second to show where it doesn’t.
A word on
In netstat command, flag
P is used to display if the interface is in promiscuous mode. However,
P is also used for point to point connection. You can verify from the net-tools code here
Example 1: When it works
Following example, sets the promiscuous mode on using the
netstat -i command. You can verify it using the
iproute2 command and kernel logs.
Verify that promiscuous mode is not enabled.
Enable the promiscuous mode.
Check if promiscuous mode is enabled (see
Let’s check the kernel log messages, as logged in __dev_set_promiscuity whenever a device is added/removed to/from promiscuous mode.
Example 2: When it doesn’t work
Consider this for example, adding an interface to bridge; set the promiscuous mode on for that interface. Check out the post Linux Bridge - how it works to learn more about bridge.
Following example creates a bridge, a veth pair and adds one end of the veth pair to bridge. According to
br_add_if, promiscuous mode is turned on for the interface.
Create a new interface and add it to a bridge
Check if promiscuous mode is enabled using
It doesn’t show the device to be in promiscuous mode as
PROMISC is not set and the flag P is not present in netstat
Let’s check kernel logs and see if the device was actually put into promiscuous mode.
As expected, the device was in fact moved to promiscuous mode but
iproute2 doesn’t show it in promiscuous mode.