Linux – Why is the ethernet interface in promiscuous mode

linuxnetworking

I read that seeing a flag of M in netstat -i is the way to tell which of your interfaces is in promiscuous mode

I run it and I see that eth1 is in promiscuous mode

$ netstat -i
Kernel Interface table
Iface       MTU Met    RX-OK RX-ERR RX-DRP RX-OVR    TX-OK TX-ERR TX-DRP TX-OVR Flg
eth1       1500   0 1770161198      0      0      0 57446481      0      0      0 BMRU
lo        16436   0 97501566      0      0      0 97501566      0      0      0 LRU

This seems to be the case on all the machines I checked (All Centos6.0, both virtual and physical), any idea why ethernet devices would be in such a mode unless someone was running any pcap based app (sudo lsof | grep pcap shows nothing)?

I did not see any mention of promiscuous in any of the config files (sudo grep -r promis /etc)

Any ideas what puts the interface into that mode and why?

p.s. most of the posts I see seem to be security related, this is not that

EDIT:
Just an observation, I noticed that the kernel logs when the interfaces enter and exit promisc mode (specifically seeing the logs with tcpdump when the -p flag is not specified and not seeing them with that option). This helps to confirm (for me) the accepted answer.

Dec  5 11:12:23 XXXX kernel: device eth1 entered promiscuous mode
Dec  5 11:12:29 XXXX kernel: device eth1 left promiscuous mode

Best Answer

M is multicast:

# netstat -i | grep ^lo
lo        16436 0    588800      0      0 0        588800      0      0      0 LRU
# ifconfig lo multicast
# netstat -i | grep ^lo
lo        16436 0    588800      0      0 0        588800      0      0      0 LMRU

P is promiscuous:

# ifconfig lo promisc
# netstat -i | grep ^lo
lo        16436 0    588880      0      0 0        588880      0      0      0 LPRU
Related Topic