freebsd stable - Jan 2005 - NIC acting promiscuously -- how to fix?

I'm running 5.3-RELEASE-p5 on a system that is functioning as a
NAT router/firewall using "pf".  It works just fine, but . . . .

The external (Internet) network connection is giving me incoming
traffic addressed to other users all over my neighborhood (not
just the packets intended for me).  The external NIC (an Accton
MPX 5030/5038, handled via the "rl" driver) appears to be running
promiscuously; it's accepting all these incoming packets, whether
addressed to me or not.

The flags shown for the NIC by the "ifconfig" command are:

rl0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500

Note that the PROMISC flag is =not= set, but the NIC seems to
be acting in a promiscuous fashion nevertheless.

Although my firewall (an old 800-MHz Athlon system) is able to
handle this extra load, I'd really like to configure it so that
the packets not intended for my site are silently dropped and
never seen by FreeBSD at all.  (Aside from simple neatness, I'm
aware of the failings of the RealTek 8129/8139 and am hoping to
reduce overhead by filtering out the extraneous traffic before
the driver would see it.)

Any suggestions as to what I should do?  Or is what I'm asking
simply impossible (and if so, why)?  Thanks for any help.

Rich Wales            richw@richw.org            http://www.richw.org

On Tue, Jan 25, 2005 at 10:43:01AM -0800, Rich Wales
wrote:
> I'm running 5.3-RELEASE-p5 on a system that is functioning as a
> NAT router/firewall using "pf".  It works just fine, but . . . .
> 
> The external (Internet) network connection is giving me incoming
> traffic addressed to other users all over my neighborhood (not
> just the packets intended for me).  The external NIC (an Accton
> MPX 5030/5038, handled via the "rl" driver) appears to be running
> promiscuously; it's accepting all these incoming packets, whether
> addressed to me or not.
> 
> The flags shown for the NIC by the "ifconfig" command are:
> 
> rl0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
> 
> Note that the PROMISC flag is =not= set, but the NIC seems to
> be acting in a promiscuous fashion nevertheless.
> 
> Although my firewall (an old 800-MHz Athlon system) is able to
> handle this extra load, I'd really like to configure it so that
> the packets not intended for my site are silently dropped and
> never seen by FreeBSD at all.  (Aside from simple neatness, I'm
> aware of the failings of the RealTek 8129/8139 and am hoping to
> reduce overhead by filtering out the extraneous traffic before
> the driver would see it.)
> 
> Any suggestions as to what I should do?  Or is what I'm asking
> simply impossible (and if so, why)?  Thanks for any help.
Without a dump of the traffic I can't really say what you're seeing,
but on a broadcast network like Ethernet of any size containing windows
machines, half a dozen packets per second of broadcast noise is pretty
normal.  Are the packets addressed to your MAC address, but to another
non-broadcast IP?  I can conceive of configurations bugs in emulated
broadcast domains that could cause that.  If so it's an interesting bug
in your ISPs config.  If not, you may have found a bug in your NICs
driver or it's chipset/firmware.

-- Brooks

-- 
Any statement of the form "X is the one, true Y" is FALSE.
PGP fingerprint 655D 519C 26A7 82E7 2529  9BF0 5D8E 8BE9 F238 1AD4
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url :
http://lists.freebsd.org/pipermail/freebsd-stable/attachments/20050125/f642fe6f/attachment.bin

Doug Hardie wrote:
> To verify what your interface is accepting use:   tcpdump -pei rl0
> That will show the packets that it accepts including the ethernet
> headers.  Those headers should all have your MAC address in them
> (send or receive).
Very good suggestion.  Thanks.

After running the above command for a while, and examining the output,
it turns out that the large amount of traffic on my external net is
mostly ARP "who-has" requests (sent to the broadcast MAC address).
These are, of course, legitimate.

There is also a relatively small number of multicast packets -- most
of which are MDNS (multicast DNS).

So, I was mistaken; my NIC doesn't have a "promiscuity" problem
after
all.  Sorry for raising a needless alarm.

Rich Wales            richw@richw.org            http://www.richw.org