Uly.me

cloud engineer

netstat

Check Network Promiscuous Mode

Promiscuous mode is a mode for a network interface where the controller to passes all traffic it receives to the CPU instead of passing the frames to the controller. This is helpful if you want to capture all traffic as part of troubleshooting. The question is, how can you tell if your network interface is in a promiscuous mode? Here’s a couple of commands.

Here’s the default mode.

sudo ip link show eth0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1460 qdisc mq state UP mode DEFAULT group default qlen 1000
link/ether xx:xx:xx:xx:xx:xx brd ff:ff:ff:ff:ff:ff

Here’s promiscuous mode. Look for PROMISC.

sudo ip link show eth0
2: eth0: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1460 qdisc mq state UP mode DEFAULT group default qlen 1000
link/ether xx:xx:xx:xx:xx:xx brd ff:ff:ff:ff:ff:ff

The other command is netstat. Look for P flag.

netstat -i
Kernel Interface table
Iface             MTU    RX-OK RX-ERR RX-DRP RX-OVR    TX-OK TX-ERR TX-DRP TX-OVR Flg
eth0             1460 21895816      0      0 0      22645756      0      0      0 BMPRU
lo              65536    44129      0      0 0         44129      0      0      0 LRU

Finally, if you want to enable promiscuous mode, run one of these commands.

sudo ip link set eth0 promisc on
ifconfig eth0 promisc

To disable, use ifconfig.

ifconfig eth0 -promisc

Netstat

Netstat is a utility for gathering network statistics. It comes preinstalled on most systems.

If missing, here’s how to install.

# Redhat, CentOS
yum install net-tools
# Debian, Ubuntu, Mint
apt install net-tools
# SLES, SUSE
zypper install net-tools

Here are some common and useful commands.

# show version
netstat -v
# show routing table
netstat -nr
# show network interface statistics
netstat -ai
# show network connections
netstat -ant
# show network services
netstat -tulpn

Check Open Ports

If you’re running a Linux server, here’s one way of checking as to which ports are open to the public. You can use netstat for that purpose. Netstat is a command-line network utility tool that displays network connections for tcp, routing tables, and a number of network interfaces. It’s available on Linux, MacOS and Windows.

In Linux and MacOS, type the following via the Terminal.

netstat -tupln
#
# -l = only services which are listening on some port
# -n = show port number, don't try to resolve the service name
# -t = tcp ports
# -u = udp ports
# -p = name of the program
#

If you’re in Windows, open up Powershell and type in:

netstat -ano | find "LISTENING"
# or
netstat -o 5

Don’t be surprised as to what your computer is doing.