Normally, when you put an interface into promiscuous mode, it sets a flag
in the device interface structure telling the world (or anyone who wants
to check) that the device, is indeed, in promiscuous mode. This is, of
course, annoying to those of you who want to obscure this fact from prying
administrative eyes. Behold intrepid hacker, your salvation is at hand.
The following modules for FreeBSD, Linux, HP-UX, IRIX and Solaris allow you
to obscure the IFF_PROMISC bit and run all your wonderful little packet
sniffers incognito...
----[ IMPLEMENTATION DETAILS
Usage of the code is simple. After you put the interface into promiscuous
mode, you can clean the IFF_PROMISC flag with:
`./i <interface> 0`
and reset the flag with:
`./i <interface> 1`.
Note that these programs only change interface's flag value, they don't affect
NIC status. On systems which allow setting promiscuous mode by SIOCSIFFLAGS
however, any call to SIOCSIFFLAGS will make the change take effect (e.g. after
clearing promisc flag:
'ifconfig <interface> up'
will really turn off promiscuous mode). Systems for which above is true are:
FreeBSD, Linux, Irix. On these three you can run a sniffer in non-promiscuous
mode, and then some time later set IFF_PROIMISC on the interface, then with
the above command set promiscuous mode for interface. This is most useful on
FreeBSD because in doing this you won't get that annoying `promiscuous mode
enabled for <interface>' message in the dmesg buffer (it's only logged when
you enable promiscuous mode via bpf by BIOCPROMISC).
On Solaris, every alias has its own flags, so you can set flags for any alias:
'interface[:<alias number>]'
(because Solaris doesn't set IFF_PROMISC when you turn on promiscuous mode
using DLPI you don't need this program however).
----[ THE CODE
<++> EX/promisc/freebsd-p.c
/*
* promiscuous flag changer v0.1, apk
* FreeBSD version, compile with -lkvm
*
* usage: promisc [interface 0|1]
*
* note: look at README for notes
*/
#ifdef __FreeBSD__
# include <osreldate.h>
# if __FreeBSD_version >= 300000
# define FBSD3
# endif
#endif
#include <sys/types.h>
#include <sys/time.h>
#include <sys/socket.h>
#include <net/if.h>
#ifdef FBSD3
# include <net/if_var.h>
#endif