Re: [cobalt-security] promisc and Cobalt kernel

[ProServe - Peter Batenburg <peter@xxxxxxxxxxx>]

Hi Gossi,

About 6 months ago i tried to recompile 2.2.14C10 on a raq3 with openwall
& stealth patches. The kernel compiled, and i installed it sucessfully.
The only problem i had was when i started trafshow (promisc) or added a
new ip with ifconfig, was that the network seems to freeze. The box still
runs, but all network activity stops. Completely the same as in your
story. And no, it had nothing to do with the stealth patch. I stil haven't
found out what the problem was.

With kind regards,

Peter Batenburg

ProServe
Prisma 100
3364 DJ Sliedrecht
Tel.: 0184 - 423 815
Fax: 0184 - 417 160
http://www.proserve.nl

On Wed, 23 May 2001, Gossi The Dog wrote:

>
> Hi,
>
> I've got a bizzare problem on owned.lab6.com.  We run snort as our IDS.
> Since installing the RPM for the kernel to the fix the latest security
> problems, if I run something else which tries to put the NIC into promisc
> mode (for example, another sniffer), all networking drops out on the box
> completely.  It sits logging stuff in syslog and is alive, but I can't
> print/traceroute or get any kind of response from it.  I'm thinking its a
> kernel problem - can anybody else test?
>
> Regards,
> Gossi.
>