NIC acting promiscuously -- how to fix?

[Brooks Davis]

On Tue, Jan 25, 2005 at 10:43:01AM -0800, Rich Wales wrote:
> I'm running 5.3-RELEASE-p5 on a system that is functioning as a
> NAT router/firewall using "pf".  It works just fine, but . . . .
> 
> The external (Internet) network connection is giving me incoming
> traffic addressed to other users all over my neighborhood (not
> just the packets intended for me).  The external NIC (an Accton
> MPX 5030/5038, handled via the "rl" driver) appears to be running
> promiscuously; it's accepting all these incoming packets, whether
> addressed to me or not.
> 
> The flags shown for the NIC by the "ifconfig" command are:
> 
> rl0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
> 
> Note that the PROMISC flag is =not= set, but the NIC seems to
> be acting in a promiscuous fashion nevertheless.
> 
> Although my firewall (an old 800-MHz Athlon system) is able to
> handle this extra load, I'd really like to configure it so that
> the packets not intended for my site are silently dropped and
> never seen by FreeBSD at all.  (Aside from simple neatness, I'm
> aware of the failings of the RealTek 8129/8139 and am hoping to
> reduce overhead by filtering out the extraneous traffic before
> the driver would see it.)
> 
> Any suggestions as to what I should do?  Or is what I'm asking
> simply impossible (and if so, why)?  Thanks for any help.

Without a dump of the traffic I can't really say what you're seeing,
but on a broadcast network like Ethernet of any size containing windows
machines, half a dozen packets per second of broadcast noise is pretty
normal.  Are the packets addressed to your MAC address, but to another
non-broadcast IP?  I can conceive of configurations bugs in emulated
broadcast domains that could cause that.  If so it's an interesting bug
in your ISPs config.  If not, you may have found a bug in your NICs
driver or it's chipset/firmware.

-- Brooks

-- 
Any statement of the form "X is the one, true Y" is FALSE.
PGP fingerprint 655D 519C 26A7 82E7 2529  9BF0 5D8E 8BE9 F238 1AD4
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-stable/attachments/20050125/f642fe6f/attachment.bin