:~ $ sudo ip link set eth0 promisc onĬheck if promiscuous mode is enabled (see PROMISC) using iproute2 :~ $ sudo ip link show eth0Įth0 1500 0 28880 0 0 0 17050 0 0 0 BMPRU Iface MTU Met RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR FlgĮnable the promiscuous mode. Verify that promiscuous mode is not enabled. You can verify it using the iproute2 command and kernel logs. You can verify from the net-tools code here Example 1: When it worksįollowing example, sets the promiscuous mode on using the iproute2 and netstat -i command. However, P is also used for point to point connection. In netstat command, flag P is used to display if the interface is in promiscuous mode. We’ll consider two examples here, first to show the case where it works as expected and second to show where it doesn’t. Here’s a quick python script to test promiscuous mode for all interfaces:įiguring out if a given network device is in promiscuous mode using tools like iproute2 or netstat can be trickier than you’d think.Īt first glance, you’d think iproute2 or netstat -i command should tell you if the device is in promiscuous mode but that’s not always the case. $ cat /sys/devices/virtual/net/br0/flagsĠx1003 # 00 0011 # device is not in promiscuous mode. $ cat /sys/devices/virtual/net/veth0/flagsĠx1303 # 00 0011 # device is in promiscuous mode.

For promiscuous mode, IFF_PROMISC, 0x100 should be set.įor a given interface, check the flags to see if the promiscuous bit is set. Tl dr: Kernel tracks promiscuous mode using flags on the device. How do I tell if a device is in promiscuous mode? Wikipedia defines promiscuous mode as a mode for a wired network interface controller (NIC) or wireless network interface controller (WNIC) that causes the controller to pass all traffic it receives to the central processing unit (CPU)rather than passing only the frames that the controller is intended to receive.

Wireshark promiscuous mode wired