What you say about being "normal" doesn't sound quite right............
I got this from an HP forum: ************** ifPromiscuousMode OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-write STATUS current DESCRIPTION "This object has a value of false(2) if this interface only accepts packets/frames that are addressed to this station. This object has a value of true(1) when the station accepts all packets/frames transmitted on the media. The value true(1) is only legal on certain types of media. If legal, setting this object to a value of true(1) may require the interface to be reset before becoming effective. The value of ifPromiscuousMode does not affect the reception of broadcast and multicast packets/frames by the interface." **************** I don't think its normal for a switch to be this way. Its normal for a hub to be that way. The above description seems right - " if this interface only accepts packets/frames that are addressed to this station" The part about accepting multicast and broadcast packets/frames sound like what you mean. However, only traffic meant for that port should be forwarded to the end hosts. (But I guess it has to accept all to filter) I just checked about the SNMP v1 and V2 probes. Only the v2 probes are reporting this. Is it possible that Intermapper has a little bug and got the true/false state backwards somewhere along the line???? This fits with the description from HP. I can't imagine that a switch should ever be in promiscuous mode unless it is a mirror port for monitoring/sniffing. And then it would usually be only one port - the port accepting monitoring. All switches with the SNMP v2 probe are now reporting promiscuous mode on every interface. Anybody else out there see this warning in red: Promiscuous Mode Enabled ?????? This only shows on the interface status page - not the device status page. I will have to try and walk this mib and see. I think what you said and what the HP guys said is so close to being the same but not quite. You say that a switch must accept all packets as normal (true) whereas the HP guys seem to say that only packets addressed to the port (false) is normal. With the replies from both of you I can now see that Cisco devices also report the same. This would indicate that either you are right about what is "normal" or that Intermapper has it backwards as it happens on different vendors eqpt and is not likely a vendor SNMP issue. This didn't show before. We are on ver 4.5.5. With the red lettering I think I would have noticed this so I feel it's a recent change. I look at interface status all the time. I'll be copying your reply to HP for their opinion. Thanks for the response but I think we need a bit more investigation on this. Kevin -----Original Message----- From: [email protected] [mailto:[EMAIL PROTECTED] On Behalf Of William W. Fisher Sent: 29-Apr-07 19:27 To: InterMapper Discussion Subject: Re: [IM-Talk] Intermapper Shows "Promiscuous Mode Enabled" Kevin Wigle wrote: > Just today I noticed on an HP 2824 with the SNMP probe, on each port > Intermapper shows "Promiscuous Mode Enabled" in red in the "Other Info" > field on the status page. > > There is another 2824 directly connected to this one and it does not show > this info. Is the other 2824 switch being probed using SNMPv1? InterMapper only checks the "ifPromiscuousMode" variable when probing a device with SNMPv2c or SNMPv3, so you will never see the promiscuous mode warning when probing with SNMPv1. ifPromiscuousMode "has a value of true(1) when the station accepts all packets/frames transmitted on the media." For the interfaces on a switch, this is the normal mode of operation. A switch needs to receive all packets on its interfaces so it can forward them if necessary. For interfaces on a server or router, an interface would only be in promiscuous mode if it was running packet sniffing software. > Being in red must mean that Intermapper wants me to be aware. I have filed an ER to have this removed when the device is known to be switch. It's normal for a switch to have interfaces in promiscuous mode. Regards, Bill Fisher Dartware, LLC ____________________________________________________________________ List archives: http://www.mail-archive.com/intermapper-talk%40list.dartware.com/ To unsubscribe: send email to: [EMAIL PROTECTED] ____________________________________________________________________ List archives: http://www.mail-archive.com/intermapper-talk%40list.dartware.com/ To unsubscribe: send email to: [EMAIL PROTECTED]
