Date: Thu, 25 Jul 2002 00:20:19 +0400 (GMT)
From: Ricardo Branco <97-29312@ldc.usb.ve>
To: bugtraq@securityfocus.com
Subject: Interface promiscuity obscurity in Linux
This affects Linux 2.2 and 2.4
Using libpcap to put the interface in promiscuous mode, will cause that
ifconfig(8) doesn't show it!
libpcap uses setsockopt(..., SOL_PACKET, PACKET_ADD_MEMBERSHIP, ...) with
PACKET_MR_PROMISC to set the interface in promiscuous mode.
I notified this to the tcpdump-workers mailing list and the problem is
that the setsockopt() sets the promisc flag in a variable that is not the
same as the one that the SIOCGIFFLAGS ioctl() reads. I don't have the
kernel source right now to make this advisory more precise.
Well, sorry for my not-so-good english
Enjoy
