Linux – tcpdump -i any and promiscuous mode

linuxnetworkingtcpdump

From the man page for tcpdump 4.1.1 (yes I know its old)

   -i     Listen  on interface.  If unspecified, tcpdump searches the 
          system interface list for the lowest numbered, configured up 
          interface (excluding loopback).  Ties are broken by choosing >               the earliest match.

          On Linux systems with 2.2 or later kernels, an interface 
          argument of ``any'' can be used to capture packets from all
          interfaces.
          Note  that captures on the ``any'' device will not be done in
          promiscuous mode.

Can anyone shed light on what exactly is meant by the last statement. I'm working with an IDS server that has many interfaces and when I use tcpdump -i any, it clearly shows traffic not sourced/destined for the IDS server. However there is another service that already puts all the interfaces into promiscuous mode. Do they maybe just mean that if you use -i any that tcpdump won't put the interfaces into PROMISC mode?

Best Answer

Do they maybe just mean that if you use -i any that tcpdump won't put the interfaces into PROMISC mode?

Yes, that's what I meant by that. The "any" device doesn't work by opening all devices independently and capturing on them, it works by opening a "packet socket" and, instead of binding it to a particular device (which is how you capture on that device on Linux), leaving it unbound so it listens to all sockets.

The call to set promiscuous mode would fail on an unbound socket (I just tested it on a fairly recent kernel), so libpcap will not turn promiscuous mode on for the "any" device.

Related Question