Re: Antwort: [ethereal-users] How to get started ?

[Guy Harris <guy@xxxxxxxxxx>]

> You can also check out with an " ifconfig tr0 " , after starting ethereal or
> tcpdump if you adapter is running in promiscous mode:

What happens, in Linux 2.x kernels, if an attempt is made to set
promiscuous mode on a device that doesn't support it? Is the attempt
rejected with an error, or silently ignored - i.e., will you get an
error, or will the device have its IFF_PROMISC flag set (presumably
making PROMISC show up in the "ifconfig" output) but not be put into
promiscuous mode?

Some Token Ring cards don't support promiscuous mode; the page at

	http://www.lmd.jussieu.fr/faqs/computer-security/sniffers/

(and probably other places) says:

	Non-promiscuous Interfaces

	You can try to make sure that most IBM DOS compatible machines
	have interfaces that will not allow sniffing.  Here is a list of
	cards that do not support promiscuous mode:

	Test the interface for promiscuous mode by using the Gobbler. 
	If you find a interface that does do promiscuous mode and it is
	listed here, please e-mail cklaus@xxxxxxx so I can remove it
	ASAP.

	     IBM Token-Ring Network PC Adapter
	     IBM Token-Ring Network PC Adapter II (short card)
	     IBM Token-Ring Network PC Adapter II (long card)
	     IBM Token-Ring Network 16/4 Adapter
	     IBM Token-Ring Network PC Adapter/A
	     IBM Token-Ring Network 16/4 Adapter/A
	     IBM Token-Ring Network 16/4 Busmaster Server Adapter/A

	The following cards are rumoured to be unable to go into
	promiscuous mode, but that the veracity of those rumours is
	doubtful.

	     Microdyne (Excelan) EXOS 205
	     Microdyne (Excelan) EXOS 205T
	     Microdyne (Excelan) EXOS 205T/16
	     Hewlett-Packard 27250A EtherTwist PC LAN Adapter Card/8
	     Hewlett-Packard 27245A EtherTwist PC LAN Adapter Card/8
	     Hewlett-Packard 27247A EtherTwist PC LAN Adapter Card/16
	     Hewlett-Packard 27248A EtherTwist EISA PC LAN Adapter Card/32
	     HP 27247B EtherTwist Adapter Card/16 TP Plus
	     HP 27252A EtherTwist Adapter Card/16 TP Plus
	     HP J2405A EtherTwist PC LAN Adapter NC/16 TP

	Adapters based upon the TROPIC chipset generally do not support
	promiscuous mode.  The TROPIC chipset is used in IBM's Token
	Ring adapters such as the 16/4 adapter.  Other vendors (notably
	3Com) also supply TROPIC based adapters.  TROPIC-based adapters
	do accept special EPROMs, however, that will allow them to go
	into promiscuous mode.  However, when in promiscuous mode, these
	adapters will spit out a "Trace Tool Present" frame.

(I'm not a Token Ring expert, and don't know whether the Madge card
supports promiscuous mode or not.)

Gilbert, we should probably make a FAQ entry on promiscuous mode and
Token Ring cards, given that the impression I have, at least, is that TR
interfaces are more likely than Ethernet interfaces not to support
promiscuous mode.