On Tue, 2005-08-23 at 14:33 -0500, Teo Fonrouge wrote: > Paul Howarth wrote: > > On Tue, 2005-08-23 at 20:52 +0200, Oliver Leitner wrote: > > > >>-----BEGIN PGP SIGNED MESSAGE----- > >>Hash: RIPEMD160 > >> > >>Teo Fonrouge wrote: > >> > >>| Hello, > >>| > >>| Using a FC4 box. > >>| > >>| Checking in my /var/log/messages file I noticed that the kernel has > >>| setting my eth0 interface in promiscuous mode regularly: > >>| > >>| Aug 21 14:30:38 sx1 kernel: eth0: Setting promiscuous mode. Aug 21 > >>| 14:30:38 sx1 kernel: device eth0 entered promiscuous mode Aug 21 > >>| 14:30:38 sx1 kernel: bridge-eth0: enabled promiscuous mode Aug 21 > >>| 14:31:36 sx1 kernel: device eth0 left promiscuous mode Aug 21 > >>| 14:31:36 sx1 kernel: bridge-eth0: disabled promiscuous mode Aug 21 > >>| 14:31:36 sx1 kernel: eth0: Setting promiscuous mode. Aug 21 > >>| 14:31:36 sx1 kernel: device eth0 entered promiscuous mode Aug 21 > >>| 14:31:36 sx1 kernel: bridge-eth0: enabled promiscuous mode > >>| > >>| I believe that I haven't ran any program that causes this. > >>| > >>| It is a normal kernel operation ? > >>| > >>| How can I know what is causing this ? > >>| > >>| > >>| best regards > >>| > >>| Teo Fonrogue > >>| > >>does any of these programs ring a bell?: > >> > >>iptraf > >>tcpdump > >>ethereal > >> > >>or any other monitoring program? > > > > > > Or VMware? > > > > Paul. > > Yes. > > VMware is running in this box. > > hmmmmmmmm. > > How do you know that VMware maybe is causing this ? > > About the WinXP Client machine running regularly run on it: of course > I'll have to check if this windoze has some virus/spy*/nastythings. If you're running bridged networking for your VMware guest, it has to put the interfaces into promiscuous mode so that you can receive packets for the guest. This is normal. Paul. -- Paul Howarth <paul@xxxxxxxxxxxx>
