# promiscuous mode on a soekris net4501



## schmurfy (Sep 14, 2010)

Hello,
I came upon a strange problem today, I have a net4501 with freebsd 8 on it (built with nanobsd), it works fine but for some reason whenever i put one interface in promiscuous mode with tcpdump to sniff traffic there is a 1s "pause" in traffic on this interface.

I use packet filter as firewall.

Does anyone experienced something similar ?


----------



## DutchDaemon (Sep 14, 2010)

Which flags are you using to tcpdump(1)? I normally use [cmd=]tcpdump -s 0 -pnli <if>[/cmd]
In your case, the *p* would be omitted to achieve promiscuous mode. These flags cause no delay, and 'full width' (snap length).


----------



## schmurfy (Sep 16, 2010)

I used
`$ tcpdump -lni <if>`
to listen to traffic but that's the first time I notice any direct impact on interface traffic, could it be the way the sis driver or hardware handle promiscuous mode ?
I known the "p" flag can be used to avoid using promiscuous but I am more curious about the reason behind this strange problem.

From my understanding switching to promiscuous mode should be completely transparent and have no effect on traffic but I may be wrong on that :\


----------



## yongari@ (Sep 19, 2010)

I'm not sure what ethernet driver you use on net4502 but I guess it would be sis(4). sis(4) had several issues in link state tracking as well as promiscuous mode programming. It used to reinitialize controller even though it was not absolutely required. Previously, toggling promiscuous mode reinitialized controller which in turn took more time to establish a valid link with link partner again.

HEAD has improved sis(4) which solved almost all known issues to me. I didn't MFC these changes to stable/8 and stable/7 yet but I will do in near future. See SVN/CVS logs for sis(4) changes.


----------



## schmurfy (Sep 21, 2010)

Thanks for the explanations, now i understand better what happens.
The driver I use is sis as you guessed and the reinitialization looks really close to what i noticed on this box.


----------

