To detect if a local interface is in promiscuous mode, run:
# netstat -i Kernel Interface table Iface MTU RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg enp1s0 1500 41831 0 0 0 32796 0 0 0 BMRU enp3s0 1500 0 0 0 0 0 0 0 0 BMU enp4s0 1500 2847577 0 308126 0 2433906 0 0 0 BMRU lo 65536 1 0 0 0 1 0 0 0 LRU veth1n 1500 1354033 0 2752094 0 1469155 0 72704 0 BMRU
The above command, no interfaces are in promiscuous mode. By setting the mode, and running the check again, the interface is in promiscuous mode with the 'P' flag:
# ip link set dev enp4s0 promisc on # netstat -i Kernel Interface table Iface MTU RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg enp1s0 1500 41871 0 0 0 32833 0 0 0 BMRU enp3s0 1500 0 0 0 0 0 0 0 0 BMU enp4s0 1500 2847700 0 308126 0 2434033 0 0 0 BMPRU lo 65536 1 0 0 0 1 0 0 0 LRU veth1n 1500 1354033 0 2752094 0 1469161 0 72704 0 BMRU
List of flags:
- B: broadcast
- M: multicast
- P: promisc mode
- R: running
- U: up