[CentOS] how to find out promiscuous mode

[Bill Campbell]

On Wed, Feb 03, 2010, Vadkan Jozsef wrote:
>How can I find out that someone is using it's network card in
>promiscuous mode in a subnet?

We use the swatch log watcher, to detect lines like this in
/var/log/messages (this is from a system running VMware virtual
machines in bridging mode so this is normal):

Jan 28 17:35:57 pogo kernel: device eth1 entered promiscuous mode

Bill
-- 
INTERNET:   bill at celestial.com  Bill Campbell; Celestial Software LLC
URL: http://www.celestial.com/  PO Box 820; 6641 E. Mercer Way
Voice:          (206) 236-1676  Mercer Island, WA 98040-0820
Fax:            (206) 232-9186  Skype: jwccsllc (206) 855-5792

Our Foreign dealings are an Open Book, generally a Check Book.
    Will Rogers