> You can also check out with an " ifconfig tr0 " , after starting ethereal or
> tcpdump if you adapter is running in promiscous mode:
What happens, in Linux 2.x kernels, if an attempt is made to set
promiscuous mode on a device that doesn't support it? Is the attempt
rejected with an error, or silently ignored - i.e., will you get an
error, or will the device have its IFF_PROMISC flag set (presumably
making PROMISC show up in the "ifconfig" output) but not be put into
promiscuous mode?
Some Token Ring cards don't support promiscuous mode; the page at
http://www.lmd.jussieu.fr/faqs/computer-security/sniffers/
(and probably other places) says:
Non-promiscuous Interfaces
You can try to make sure that most IBM DOS compatible machines
have interfaces that will not allow sniffing. Here is a list of
cards that do not support promiscuous mode:
Test the interface for promiscuous mode by using the Gobbler.
If you find a interface that does do promiscuous mode and it is
listed here, please e-mail cklaus@xxxxxxx so I can remove it
ASAP.
IBM Token-Ring Network PC Adapter
IBM Token-Ring Network PC Adapter II (short card)
IBM Token-Ring Network PC Adapter II (long card)
IBM Token-Ring Network 16/4 Adapter
IBM Token-Ring Network PC Adapter/A
IBM Token-Ring Network 16/4 Adapter/A
IBM Token-Ring Network 16/4 Busmaster Server Adapter/A
The following cards are rumoured to be unable to go into
promiscuous mode, but that the veracity of those rumours is
doubtful.
Microdyne (Excelan) EXOS 205
Microdyne (Excelan) EXOS 205T
Microdyne (Excelan) EXOS 205T/16
Hewlett-Packard 27250A EtherTwist PC LAN Adapter Card/8
Hewlett-Packard 27245A EtherTwist PC LAN Adapter Card/8
Hewlett-Packard 27247A EtherTwist PC LAN Adapter Card/16
Hewlett-Packard 27248A EtherTwist EISA PC LAN Adapter Card/32
HP 27247B EtherTwist Adapter Card/16 TP Plus
HP 27252A EtherTwist Adapter Card/16 TP Plus
HP J2405A EtherTwist PC LAN Adapter NC/16 TP
Adapters based upon the TROPIC chipset generally do not support
promiscuous mode. The TROPIC chipset is used in IBM's Token
Ring adapters such as the 16/4 adapter. Other vendors (notably
3Com) also supply TROPIC based adapters. TROPIC-based adapters
do accept special EPROMs, however, that will allow them to go
into promiscuous mode. However, when in promiscuous mode, these
adapters will spit out a "Trace Tool Present" frame.
(I'm not a Token Ring expert, and don't know whether the Madge card
supports promiscuous mode or not.)
Gilbert, we should probably make a FAQ entry on promiscuous mode and
Token Ring cards, given that the impression I have, at least, is that TR
interfaces are more likely than Ethernet interfaces not to support
promiscuous mode.