Red Hat Bugzilla – Bug 119725
promiscuous mode flip-flop after network restart
Last modified: 2007-11-30 17:07:01 EST
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4) Gecko/20030624
Description of problem:
When the network is restartd while a process in a promiscuous network
read, the mode of the interface gets messed up. The device will leave
promiscuous mode when a promiscuous read is opened, and enter
promiscuous mode when the read is closed.
See post by Jim Nisbet:
I have verified that the patch works with kernel 2.4.21-4.EL, and
kernel 2.4.20-30.9 (RH9)
Version-Release number of selected component (if applicable):
Steps to Reproduce:
3. wait for interface to come back up
4. run tcpdump again
5. stop tcpdump
Actual Results: 1. See packets on ethX. log: ethX entered promiscuous
mode -- good
2. tcpdump quits when interface is down -- good
3. interfacea comes back up -- good
4. don't see any packets. log: ethX left promiscuous mode -- BAD
5. log: ethX entered promiscuous mode -- BAD
Expected Results: 1. See packets on ethX. log: ethX entered
2. tcpdump quits when interface is down
3. interfacea comes back up
4. See packets again. log: ethX entered promiscuous mode
5. log: ethX left promiscuous mode
Once this happens, the only way to get back to normal is to reboot. It
is possible to put the device into promiscuous mode by starting 1+n
tcpdump processes at the same time, where n is the number of times the
network has been restarted with the device in promiscuous mode.
Obviously, this is not a good solution.
Created attachment 99051 [details]
Patch file from Jim Nisbet
I have verified that the patch works with RH Enterprise kernel 2.4.21-4.EL, and
RH 9 kernel 2.4.20-30.9
This is tricky to fix. There are two things at work here:
1) There is a IFF_PROMISC device state, and a user program can
set/clear this bit using SIOCSIFFLAGS ioctl. The proposed patch
breaks this part of the interface.
2) There is a promiscuous count, which keeps track of how many promiscuos
enables have ocurred.
I'll look into this more deeply.
Created attachment 99093 [details]
Fix for promisc bug
This fix by email@example.com is the correct one.
David's patch in comment #3 has just been committed to the RHEL3 U3
patch pool (in kernel version 2.4.21-15.2.EL).
An errata has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.