Solved Cannot Disable Interface's Promiscuous mode on FreeBSD 11.0 STABLE

S

ssoorruu

Hi folks,

I want to disable promiscuous mode on interfaces, on FreeBSD 11.0 STABLE, but seem there's nothing happened after I run "ifconfig ix0 -promisc".

I've tried reboot it again and again, but still, there's nothing changed.

I've tried to disable the promiscuous mode, but nothing's changed:
http://imgur.com/a/f4E8A

dmesg: http://pastebin.com/XGq4nf3g
/var/log/messages: http://pastebin.com/UBmxN2Kd

Code: 
[root@phy-freebsd2 ~]# uname -a
FreeBSD phy-freebsd2 11.0-STABLE FreeBSD 11.0-STABLE #0 r308135: Mon Oct 31 19:17:52 UTC 2016     [EMAIL]root@releng2.nyi.freebsd.org[/EMAIL]:/usr/obj/usr/src/sys/GENERIC  amd64
[root@phy-freebsd2 ~]# more /etc/rc.conf
sendmail_enable="NONE"
sshd_enable="YES"
ntpd_enable="YES"
dumpdev="AUTO"
hostname="phy-freebsd2"
ifconfig_ix0="inet 192.168.14.42  netmask 255.255.255.0 -promisc up"
ifconfig_ix1="inet 192.168.200.42 netmask 255.255.255.0 -promisc up"
ifconfig_ix0_alias0="vhid 14 alias 192.168.14.40/32"
ifconfig_ix1_alias0="vhid 200 alias 192.168.200.1/32"
ifconfig_igb0="up"
ifconfig_igb1="up"
cloned_interfaces="lagg0"
ifconfig_lagg0="laggproto lacp laggport igb0 laggport igb1 192.168.201.42/24"
defaultrouter="192.168.14.1"
pf_enable="YES"
pflog_enable="YES"
pf_rules="/etc/pf.conf"
pglog_logfile="/var/log/pflog"
pfsync_enable="YES"
pfsync_syncdev="lagg0"
gateway_enable="YES"
[root@phy-freebsd2 ~]# more /boot/loader.conf
carp_load="YES"
[root@phy-freebsd2 ~]# more /etc/sysctl.conf
net.inet.ip.forwarding=1
net.inet6.ip6.forwarding=1
net.inet.carp.ifdown_demotion_factor=240
net.inet.carp.senderr_demotion_factor=240
net.inet.carp.demotion=0
net.inet.carp.log=1
net.inet.carp.preempt=1
net.inet.carp.allow=1
net.pfsync.carp_demotion_factor=240


Can you show me how to disable promiscuous mode completely on FreeBSD 11.0 STABLE?


Thank you in advance
 
Promiscuous mode is turned off by default. Only root has the ability to turn it on (running tcpdump(1) for example enables it).

Using ifconfig {...} -promisc simply turns promiscuous mode on or off, it doesn't disable it.
 
Hi SirDice,

I have make sure that there's no tcpdump process running anywhere in the OS (FreeBSD 11.0 STABLE is installed on physical machine). I even reboot it many times, but still the "PROMISCUOUS" flag is still there, this flag means that the promiscuous mode is still on, right?
Even running "ifconfig <my interface> -promisc", didn't turning off the promiscuous mode.

How to do it right?



SirDice said:
You can turn promiscuous mode on or off, why do you want to disable it?
Click to expand...
I don't quite understand the definition and difference between turning off promiscuous mode and disabling promiscuous mode.
 
ssoorruu said:
I have make sure that there's no tcpdump process running anywhere in the OS (FreeBSD 11.0 STABLE is installed on physical machine). I even reboot it many times, but still the "PROMISCUOUS" flag is still there, this flag means that the promiscuous mode is still on, right?
Click to expand...
No, it means the interface has a feature called "promiscuous".

ssoorruu said:
I don't quite understand the definition and difference between turning off promiscuous mode and disabling promiscuous mode.
Click to expand...
If something is disabled it cannot be turned on.

Again, what are you trying to accomplish?
 
SirDice said:
If something is disabled it cannot be turned on.
Click to expand...
Thank you, I will try to keep that in mind.


SirDice said:
Again, what are you trying to accomplish?
Click to expand...
In April 2016, we have setup a FreeBSD 9.3 in a physical server, for NAT using PF.
The ix0 has static public IP connected to a WAN switch, the ix1 has static private IP connected to a LAN switch.
After the FreeBSD server fully booted-up, I connect the ix0 to the WAN switch, but suddenly the other public servers that also connected to the same WAN switch and also has static public IP, were suddenly experiencing bad pings latency, fluctuating between 17ms-35ms, this is when we ping it from cloud.
After I poweroff the FreeBSD server, the pings latency of the other public servers are suddenly back to normal/stable at 12ms constantly.

At that time, we haven't done anything yet to the FreeBSD, actually there's no PF rules yet, the CARP is not yet setup.
So I guess, maybe it because of the promiscuous mode, maybe the packets from the other public servers were forced to get through the FreeBSD first instead of directly go to the ISP gateway.

So I decided to try again with the latest stable FreeBSD with promiscuous mode turned off.


SirDice said:
No, it means the interface has a feature called "promiscuous".
Click to expand...
I don't understand why on the same server with another interface (which is NIC pci card, instead of the onboard ix0-ix1), when we do "ifconfig igb0 promisc", the PROMISCUOUS flag is appear, and when we do "ifconfig igb0 -promisc", the PROMISCUOUS flag disappear.
Screen shot: http://imgur.com/a/mApDR
How can we get the same behaviour as above with the on-board interfaces? (ix0 and ix1)
 
ssoorruu said:
After the FreeBSD server fully booted-up, I connect the ix0 to the WAN switch, but suddenly the other public servers that also connected to the same WAN switch and also has static public IP, were suddenly experiencing bad pings latency, fluctuating between 17ms-35ms, this is when we ping it from cloud.
After I poweroff the FreeBSD server, the pings latency of the other public servers are suddenly back to normal/stable at 12ms constantly.
Click to expand...
This has nothing to do with promiscuous mode. A more likely scenario is a duplicate IP address or, when dealing with virtual servers, a duplicate MAC address.

ssoorruu said:
So I guess, maybe it because of the promiscuous mode, maybe the packets from the other public servers were forced to get through the FreeBSD first instead of directly go to the ISP gateway.
Click to expand...
No, this never happens, even with promiscuous mode on.

So I decided to try again with the latest stable FreeBSD with promiscuous mode turned off.
Click to expand...
Promiscuous mode is off by default. It needs to be turned on explicitly.
 
You must log in or register to reply here.
Back
Top