I found the NIC of a machine is running in promiscuous mode, now how can I locate the program who is actually capturing packets?
2
-
Suspect tcpdump and wireshark, if not I would try lsof and netstat, good luck :)– Thorsten StaerkJan 15, 2014 at 5:45
-
1Does this help? unix.stackexchange.com/questions/48250/…– slm ♦Jan 15, 2014 at 5:53
Add a comment
|
1 Answer
You could try running lsof(1) and checking all processes which have sockets open as SOCK_RAW. This will most likely give you at least one false positive, in case you're running some kind of a DHCP-client, but it will reveal processes running a network interface in promiscuous mode too.
Try something like this:
sudo lsof -Pnl | grep SOCK_RAW
-
SOCK_RAW would appear to be a way to do this: stackoverflow.com/questions/114804/…– slm ♦Jan 15, 2014 at 13:07