Re: [cobalt-users] Raq550: Chkroot results question

[Bruce Timberlake <bruce@xxxxxxxxxx>]

>> I run chkrootkit on my systems daily ...
>> On one of the Raq550's I get an extra like
>>    eth0 is not promisc
>>    eth0:1 is not promisc  [most times it is "eth0:0 is not promisc"]
>>    eth1 is not promisc
>>
>> On the others I get
>>    eth0 is not promisc
>>    eth1 is not promisc
>>
>> What really does not promisc mean?
>
>It means the interface will receive ALL packets on the network.
>Normally it would only receive packets addressed to it.

Actually if it's _not_ in promiscuous mode, it _won't_ get all
packets.  It will only get the ones addressed to it.

Promiscuous mode is used by traffic scanners, so the check is to see
if your ethernet card mode has been altered by a traffic scanner.  Not
promisc is what you want.  :)

>> What is eth0:1 ?

It's a "virtual" ethernet interface.  The "main" port, eth0, has the
primary IP for the RaQ assigned ("bound") to it.  If you're providing
multiple IP addresses (not name-based hosting, but each vsite has its
own IP), you can "bind" the alternate IPs to the same physical
ethernet port, but they need to be virtualized.  So eth0:0 is the
first virtual ethernet "port" on the physical eth0 port, eth0:1 is the
2nd virtual port, etc.  If you only assign one IP for all domains on
the RaQ to use, you would't see eth0:x.