NIC acting promiscuously -- how to fix?
brooks at one-eyed-alien.net
Tue Jan 25 11:13:56 PST 2005
On Tue, Jan 25, 2005 at 10:43:01AM -0800, Rich Wales wrote:
> I'm running 5.3-RELEASE-p5 on a system that is functioning as a
> NAT router/firewall using "pf". It works just fine, but . . . .
> The external (Internet) network connection is giving me incoming
> traffic addressed to other users all over my neighborhood (not
> just the packets intended for me). The external NIC (an Accton
> MPX 5030/5038, handled via the "rl" driver) appears to be running
> promiscuously; it's accepting all these incoming packets, whether
> addressed to me or not.
> The flags shown for the NIC by the "ifconfig" command are:
> rl0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
> Note that the PROMISC flag is =not= set, but the NIC seems to
> be acting in a promiscuous fashion nevertheless.
> Although my firewall (an old 800-MHz Athlon system) is able to
> handle this extra load, I'd really like to configure it so that
> the packets not intended for my site are silently dropped and
> never seen by FreeBSD at all. (Aside from simple neatness, I'm
> aware of the failings of the RealTek 8129/8139 and am hoping to
> reduce overhead by filtering out the extraneous traffic before
> the driver would see it.)
> Any suggestions as to what I should do? Or is what I'm asking
> simply impossible (and if so, why)? Thanks for any help.
Without a dump of the traffic I can't really say what you're seeing,
but on a broadcast network like Ethernet of any size containing windows
machines, half a dozen packets per second of broadcast noise is pretty
normal. Are the packets addressed to your MAC address, but to another
non-broadcast IP? I can conceive of configurations bugs in emulated
broadcast domains that could cause that. If so it's an interesting bug
in your ISPs config. If not, you may have found a bug in your NICs
driver or it's chipset/firmware.
Any statement of the form "X is the one, true Y" is FALSE.
PGP fingerprint 655D 519C 26A7 82E7 2529 9BF0 5D8E 8BE9 F238 1AD4
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Size: 189 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-stable/attachments/20050125/f642fe6f/attachment.bin
More information about the freebsd-stable