NIC acting promiscuously -- how to fix?

Doug Hardie bc979 at
Tue Jan 25 12:07:21 PST 2005

> On Tue, Jan 25, 2005 at 10:43:01AM -0800, Rich Wales wrote:
>> I'm running 5.3-RELEASE-p5 on a system that is functioning as a
>> NAT router/firewall using "pf".  It works just fine, but . . . .
>> The external (Internet) network connection is giving me incoming
>> traffic addressed to other users all over my neighborhood (not
>> just the packets intended for me).  The external NIC (an Accton
>> MPX 5030/5038, handled via the "rl" driver) appears to be running
>> promiscuously; it's accepting all these incoming packets, whether
>> addressed to me or not.

How are you determining that?  If you are using tcpdump without the -p 
then keep in mind it will put the interface into promiscous mode and 
you will see everything on the network regardless of who its addressed 
to.  To verify what your interface is accepting use:

tcpdump -pei rl0

That will show the packets that it accepts including the ethernet 
headers.  Those headers should all have your MAC address in them (send 
or receive).

More information about the freebsd-stable mailing list