# USB Ethernet UE0 RTL8156 not going promiscuous -- looking for tips



## Bryce Alexander (Dec 25, 2021)

I have a Startech US2GA30 with the chipset Realtek - RTL8156 that works for normal functions and appears as UE0, however I want to use it in promiscuous mode for running Snort. When I set it for promisc in ifconfig is says it is in promisc, however I only see arp and broadcast traffic which tells me it isn't actually in promiscuous. The manufacturer states that the chipset supports promiscuous, so I suspect this is in the driver. Any helpful tips for getting it to work would be appreciated.


----------



## covacat (Dec 26, 2021)

if you are in switched environment this is normal (nobody has ethernet hubs these days anyway)
unless the nic is part of a bridge


----------



## Bryce Alexander (Dec 26, 2021)

It is connected to a tap, not a switch. I am aware of the need of a span port if it were a switch. The tap is manufactured by SharkTap. This is located between the ISP handoff and my Cisco Router.

ISP--------tap-----------Cisco---{My Network}
                  |
                  |
                NIC
                IDS


----------



## Bryce Alexander (Dec 26, 2021)

Additional Information: Running FreeBSD 13.0 Release-p4 with recent freebsd-update. Searching bugs shows that the ue(4) interface documentation is missing (open bug) and reviewing the hardware compatibility I am unable to see what chipsets the ue(4) driver supports. Is there a way to see what chipset the driver believes I have and has selected when it loaded?


----------



## covacat (Dec 26, 2021)

it's supported by if_cdce
on 13.0-R there is no support for promisc but 13-STABLE seems to have it








						if_cdce: Add support for setting RX filtering · freebsd/freebsd-src@28df957
					

We can now set promisc and allmulti modes. Filtering of given multicast addresses is not supported. Changing the mode is done by sending a command described in: "USB CDC Subclass Specification...




					github.com


----------



## Bryce Alexander (Dec 28, 2021)

covacat I loaded the latest snapshot of STABLE and it does indeed work. Thanks for your help.


----------

