promiscuous mode

[Teo Fonrouge]

Oliver Leitner wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: RIPEMD160
> 
> Teo Fonrouge wrote:
> 
> | Oliver Leitner wrote:
> |
> |> -----BEGIN PGP SIGNED MESSAGE----- Hash: RIPEMD160
> |>
> |> Teo Fonrouge wrote:
> |>
> |> | Hello, | | Using a FC4 box. | | Checking in my
> |> /var/log/messages file I noticed that the kernel has |  setting
> |> my eth0 interface in promiscuous mode regularly: | | Aug 21
> |> 14:30:38 sx1 kernel: eth0: Setting promiscuous mode. Aug 21 |
> |> 14:30:38 sx1 kernel: device eth0 entered promiscuous mode Aug 21
> |> | 14:30:38 sx1 kernel: bridge-eth0: enabled promiscuous mode Aug
> |> 21 | 14:31:36 sx1 kernel: device eth0 left promiscuous mode Aug
> |> 21 | 14:31:36 sx1 kernel: bridge-eth0: disabled promiscuous mode
> |> Aug 21 | 14:31:36 sx1 kernel: eth0: Setting promiscuous mode. Aug
> |> 21 | 14:31:36 sx1 kernel: device eth0 entered promiscuous mode
> |> Aug 21 | 14:31:36 sx1 kernel: bridge-eth0: enabled promiscuous
> |> mode | | I believe that I haven't ran any program that causes
> |> this. | | It is a normal kernel operation ? | | How can I know
> |> what is causing this ? | | | best regards | | Teo Fonrogue | does
> |> any of these programs ring a bell?:
> |>
> |> iptraf tcpdump ethereal
> |
> |
> | None of this programs was running at such time.
> |
> |>
> |> or any other monitoring program?
> |
> |
> | Nope. :(
> |
> |>
> |> greetings oliver
> |
> |
> | Thank you Oliver
> |
> |
> |
> | best regards
> |
> | Teo Fonrouge
> |
> then try to look through user history, at your commandprompt type
> history, best with a less or a more combined, and look what has been
> started the past few days...
> 
> if none of it shows up well, get rkhunter, and check for any running
> backdoors....
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.1 (MingW32)
> 
> iD8DBQFDC3UUxHPquN24yVsRA2htAJ4/Cprlrf0IuOugfelF2NMh0IUs8wCeOFbY
> 5W3ic4oQ68an1ART5jK2MoM=
> =yaSf
> -----END PGP SIGNATURE-----
> 

rkhunter runned, all seems to be ok except for this message:

[...]
* Filesystem checks
    Checking /dev for suspicious files...                      [ OK ]
    Scanning for hidden files...                               [ Warning! ]
---------------
  /dev/.udevdb  /usr/share/man/man1/..1.gz  /etc/.pwd.lock
---------------
Please inspect:  /dev/.udevdb (directory)
[...]

really don't know what it means.

I'll try checking for shutting down some services in this box & see results.


Thank you for your help Oliver



best regards

Teo Fonrouge