device eth0 entered promiscuous mode

[steveoelliott]

Hi all,

I noticed something strange in my logs today, it never appears to have happened (certainly since March) before. 

Dec 17 09:15:57 despair kernel: device eth0 entered promiscuous mode
Dec 17 09:16:02 despair kernel: device eth0 left promiscuous mode

And then...

Dec 22 14:58:26 despair kernel: device eth0 entered promiscuous mode

My device is currently in Promiscous mode too, it has not left it since.

I was not logged into the device via Web or SSH around this time and I had a look at the last logins to check nobody else had gained access. I am just curious what's going on and what may cause the interface to switch to promiscous mode. Normally only TCPDUMP causes this to happen.

I did also check running processes, I find this one a little odd:

avahi-daemon: running [despair.local]

Thanks...

[Marto731]

Steve,

   For clarity, can I get the following.?

NAS model no & Firmware.

The switch it is connected to

Is there a 2nd Eth cable connected to NAS?

I would like to rule out teaming.

             Thanks, Marto

[steveoelliott]

Something on the network must be triggering this! I see the following on the secondary device I have on this LAN:

Dec 17 09:15:57 chaos kernel: device eth0 entered promiscuous mode
Dec 17 09:16:02 chaos kernel: device eth0 left promiscuous mode
Dec 22 14:58:26 chaos kernel: device eth0 entered promiscuous mode

They are connected to Cisco small business switch SD108.

No 2nd interface.

No changes have been made.

Both are ReadyNAS Pro 6 running 4.2.28.

I'm just curious as to why this should occur and also what this avahi daemon thing running is. Probably not related.

[StephenB]

---

@steveoelliott wrote:

what this avahi daemon thing running is. 

---

avahi does Apple discovery (bonjour or rendezvous).  https://en.wikipedia.org/wiki/Avahi_(software)

[steveoelliott]

Well Bonjour is disabled anyway.

[StephenB]

---

@steveoelliott wrote:

Well Bonjour is disabled anyway.

---

It is a zero-configuration networking tool - and might bundle in some some other services the NAS uses.

Are you using the iTunes server or DLNA?

[steveoelliott]

Nothing like this is enabled on the NAS. It's a business system.

I'm wondering if somebody at the customer site had plugged something into the LAN which has triggered this.

[steveoelliott]

Any further thoughts on this?

Is there a way I can prevent this from happening?

[StephenB]

You can see if stopping the avahi process takes you out of promiscuous mode (and also look for operational side effects).  It would be turned on again with every reboot of course.

If that works ok, perhaps follow up with a request to disable it from the web ui. 

[steveoelliott]

Thanks... I'd thought of that but as these are business systems (for a customer) I don't really want to play around without having prior knowledge of why something is happening. I was hoping some of the Netgear folks would comment here.

[mdgm-ntgr]

This probably relates to the IP address conflict detection deamon (ipwatchd).

Have you got your DHCP server (e.g. router) to reserve an I.P. address for the MAC address of the NIC in your NAS? If not, perhaps try that and see if it helps.

[steveoelliott]

Hi,

Thanks for the reply.

No I haven't I assign them statically and exclude them from the range on the DHCP server.

This has always been the case.

Both units have entered and left promiscuous mode at the same time, although it's been on both units since 22nd December:

Dec 17 09:15:57 chaos kernel: device eth0 entered promiscuous mode
Dec 17 09:16:02 chaos kernel: device eth0 left promiscuous mode
Dec 22 14:58:26 chaos kernel: device eth0 entered promiscuous mode

Why would this suddenly change?

[mdgm-ntgr]

Not sure what would cause this then.

Did you experience any problems at that time? Is having it in promiscuous mode causing problems for you?

[steveoelliott]

No issues at all at the time or now... However, being in promiscuous mode elevates the CPU since the CPU processes EVERYTHING the NIC hears.

Also being an engineer, I never like something which I cannot explain or know the cause of. Otherwise things have a tendancy to rear their head later... 

I'm sure others must have seen this but perhaps completely unaware.

I have just reloaded the secondary CHAOS and currently it is not running in promiscuous mode. So whilst the trigger occured at the same time, it seems it's no longer there. However, as you see on the 17th both devices entered and left this mode at the same time and went back to this mode on 22nd.

So strange....

[steveoelliott]

Hi all,

Whilst a reboot solved the issue, I then saw the following appear again:

Jan 20 17:36:35 chaos kernel: device eth0 entered promiscuous mode
Jan 20 17:36:39 chaos kernel: device eth0 left promiscuous mode
Jan 20 17:37:20 chaos kernel: device eth0 entered promiscuous mode
Jan 20 17:37:24 chaos kernel: device eth0 left promiscuous mode

This occured on both NAS's connected to the same network at the same time. Still no idea what may have caused this...

Thanks...