1使用ifconfig命令可查看当前网卡是否设置为混杂模式
[zhaihf@localhost~]$ ifconfig
eth0 Linkencap:Ethernet HWaddr 00:16:31:FF:A6:2E
inet addr:192.168.9.1 Bcast:192.168.9.255 Mask:255.255.255.0
UPBROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
Memory:98420000-98440000
eth1 Link encap:Ethernet HWaddr 00:16:31:FF:A6:2F
inet addr:192.168.8.48 Bcast:192.168.8.255 Mask:255.255.255.0
inet6 addr: fe80::216:31ff:feff:a61f/64 Scope:Link
UPBROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1
RX packets:28011022 errors:0 dropped:0 overruns:0 frame:0
TX packets:18408510 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:31733322503 (29.5 GiB) TX bytes:21092798216 (19.6GiB)
Memory:98400000-98420000
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:8873 errors:0 dropped:0 overruns:0 frame:0
TX packets:8873 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:3140421 (2.9 MiB) TX bytes:3140421 (2.9 MiB)
usb0 Link encap:Ethernet HWaddr 5E:F3:FC:E1:D2:19
inet addr:169.254.95.120 Bcast:169.254.95.255 Mask:255.255.255.0
inet6 addr: fe80::5cf3:fcff:fee1:d217/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RXpackets:220031 errors:0 dropped:0 overruns:0 frame:0
TX packets:110230 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:14862206 (14.1 MiB) TX bytes:5251125 (5.0 MiB)
其中UPBROADCAST RUNNING PROMISC MULTICAST的PROMISC说明网卡eth1已经设置成混杂模式。
字段含义说明：
eth0/eth1: 分别表示第一块网卡和第二块网卡；
lo: 表示回环测试接口，注意，这个虚拟的interface一定要存在！
usb0: 表示USB接口的网卡；
Linkencap: 表示位于OSI物理层的名称，即连接类型Ethernet（以太网）
HWaddr: 表示网卡的硬件地址，即MAC地址
inetaddr: 表示网卡IP；
Bcast: 表示广播(broadcast ) 的地址；
Mask: 表示子网掩码；
UP: 表示网卡开启状态；
BROADCAST: 表示支持广播；
MULTICAST: 表示网卡混杂模式；
RUNNING: 表示网卡的网线被接上；
MULTICAST: 表示支持组播；
MTU: 表示MaximumTrasmission Unit 最大传输单元(字节)，即此接口一次所能传输的最大封包；
Metric: 表示路由度量值，缺省值是0；
RX: 表示网络由激活到目前为止接收的数据包；
TX: 表示网络由激活到目前为止发送的数据包；
collisions: 表示网络信号冲突的情况；
txqueuelen: 表示传输缓冲区长度大小；
Memory: 表示占用内存范围。
2设置混杂模式
[zhaihf@localhost~]$ifconfigeth1 promisc
3命令
3.1help
[zhaihf@localhost~]$ifconfig --help
Usage:
ifconfig[-a] [-v] [-s] <interface> [[<AF>] <address>]
[add<address>[/<prefixlen>]]
[del<address>[/<prefixlen>]]
[[-]broadcast[<address>]] [[-]pointopoint [<address>]]
[netmask<address>] [dstaddr <address>] [tunnel <address>]
[outfill<NN>] [keepalive <NN>]
[hw<HW> <address>] [metric <NN>] [mtu <NN>]
[[-]trailers] [[-]arp] [[-]allmulti]
[multicast] [[-]promisc]
[mem_start<NN>] [io_addr <NN>] [irq <NN>] [media <type>]
[txqueuelen<NN>]
[[-]dynamic]
[up|down]...
<HW>=HardwareType.
Listof possible hardware types:
loop(Local Loopback) slip (Serial Line IP) cslip (VJ Serial Line IP)
slip6(6-bit Serial Line IP) cslip6 (VJ 6-bit Serial Line IP) adaptive(Adaptive Serial Line IP)
strip(Metricom Starmode IP) ash (Ash) ether (Ethernet)
tr(16/4 Mbps Token Ring) tr (16/4 Mbps Token Ring (New)) ax25 (AMPRAX.25)
netrom(AMPR NET/ROM) rose (AMPR ROSE) tunnel (IPIP Tunnel)
ppp(Point-to-Point Protocol) hdlc ((Cisco)-HDLC) lapb (LAPB)
arcnet(ARCnet) dlci (Frame Relay DLCI) frad (Frame Relay Access Device)
sit(IPv6-in-IPv4) fddi (Fiber Distributed Data Interface) hippi (HIPPI)
irda(IrLAP) ec (Econet) x25 (generic X.25)
infiniband(InfiniBand)
<AF>=Addressfamily. Default: inet
Listof possible address families:
unix(UNIX Domain) inet (DARPA Internet) inet6 (IPv6)
ax25(AMPR AX.25) netrom (AMPR NET/ROM) rose (AMPR ROSE)
ipx(Novell IPX) ddp (Appletalk DDP) ec (Econet)
ash(Ash) x25 (CCITT X.25)
2.2man ifconfig
NAME
ifconfig- configure a network interface
SYNOPSIS
ifconfig[interface]
ifconfiginterface [aftype] options | address ...
DESCRIPTION
Ifconfig is used to configure the kernel-resident network interfaces.
Itis used at boot time to set up interfaces as necessary. After that,
it is usually only needed when debugging or when system tuning is
needed.
Ifno arguments are given, ifconfig displays the status of the cur-
rently active interfaces. If a single interface argument is given, it
displaysthe status of the given interface only; if a single -a argu-
ment is given, it displays the status of all interfaces, even those
thatare down. Otherwise, it configures an interface.
AddressFamilies
Ifthe first argument after the interface name is recognized as the
name of a supported address family, that address family is used for
decodingand displaying all protocol addresses. Currently supported
address families include inet (TCP/IP, default), inet6 (IPv6), ax25
(AMPRPacket Radio), ddp (Appletalk Phase 2), ipx (Novell IPX) and
netrom(AMPR Packet radio). All numbers supplied as parts in IPv4 dot-
teddecimal notation may be decimal, octal, or hexadecimal, as speci-
fied in the ISO C standard (that is, a leading 0x or 0X implies hex-
adecimal;otherwise, a leading ’0’ implies octal; otherwise, the number
is interpreted as decimal). Use of hexamedial and octal numbers is not
RFC-compliantand therefore its use is discouraged and may go away.
OPTIONS
interface
Thename of the interface. This is usually a driver name fol-
lowed by a unit number, for example eth0 for the first Ethernet
interface.
up This flag causes the interface to be activated. It is implic-
itlyspecified if an address is assigned to the interface.
down This flag causes the driver for this interface to be shut down.
[-]arpEnable or disable the use of the ARP protocol on this interface.
[-]promisc
Enable or disable the promiscuous mode of the interface. If
selected,all packets on the network will be received by the
interface.
[-]allmulti
Enable or disable all-multicast mode. If selected, all multi-
castpackets on the network will be received by the interface.
metricN
Thisparameter sets the interface metric.
mtuN This parameter sets the Maximum Transfer Unit (MTU) of an inter-
face.
dstaddraddr
Set the remote IP address for a point-to-point link (such as
PPP). This keyword is now obsolete; use the pointopoint keyword
instead.
netmaskaddr
Setthe IP network mask for this interface. This value defaults
tothe usual class A, B or C network mask (as derived from the
interfaceIP address), but it can be set to any value.
addaddr/prefixlen
Addan IPv6 address to an interface.
deladdr/prefixlen
Removean IPv6 address from an interface.
tunnel::aa.bb.cc.dd
Create a new SIT (IPv6-in-IPv4) device, tunnelling to the given
destination.
irqaddr
Setthe interrupt line used by this device. Not all devices can
dynamicallychange their IRQ setting.
io_addraddr
Setthe start address in I/O space for this device.
mem_startaddr
Set the start address for shared memory used by this device.
Onlya few devices need this.
mediatype
Setthe physical port or medium type to be used by the device.
Notall devices can change this setting, and those that can vary
inwhat values they support. Typical values for type are
10base2(thin Ethernet), 10baseT (twisted-pair 10Mbps Ethernet),
AUI(external transceiver) and so on. The special medium type
of auto can be used to tell the driver to auto-sense the media.
Again,not all drivers can do this.
[-]broadcast[addr]
Ifthe address argument is given, set the protocol broadcast
address for this interface. Otherwise, set (or clear) the
IFF_BROADCASTflag for the interface.
[-]pointopoint[addr]
Thiskeyword enables the point-to-point mode of an interface,
meaning that it is a direct link between two machines with
nobodyelse listening on it.
Ifthe address argument is also given, set the protocol address
of the other side of the link, just like the obsolete dstaddr
keyworddoes. Otherwise, set or clear the IFF_POINTOPOINT flag
forthe interface.
hwclass address
Setthe hardware address of this interface, if the device driver
supportsthis operation. The keyword must be followed by the
nameof the hardware class and the printable ASCII equivalent of
thehardware address. Hardware classes currently supported
include ether (Ethernet), ax25 (AMPR AX.25), ARCnet and netrom
(AMPRNET/ROM).
multicast
Setthe multicast flag on the interface. This should not nor-
mally be needed as the drivers set the flag correctly them-
selves.
address
TheIP address to be assigned to this interface.
txqueuelenlength
Setthe length of the transmit queue of the device. It is useful
to set this to small values for slower devices with a high
latency(modem links, ISDN) to prevent fast bulk transfers from
disturbinginteractive traffic like telnet too much.
NOTES
Sincekernel release 2.2 there are no explicit interface statistics for
aliasinterfaces anymore. The statistics printed for the original
address are shared with all alias addresses on the same device. If you
wantper-address statistics you should add explicit accounting rules
forthe address using the ipchains(8) command.
Interrupt problems with Ethernet device drivers fail with EAGAIN. See
http://www.scyld.com/expert/irq-conflict.htmlfor more information.
FILES
/proc/net/socket
/proc/net/dev
/proc/net/if_inet6
BUGS
Whileappletalk DDP and IPX addresses will be displayed they cannot be
alteredby this command.
SEEALSO
route(8),netstat(8), arp(8), rarp(8), ipchains(8)
4 其它方法
4.1 arp
使用arp协议，向指定怀疑的ip主机发送arp协议报文，如果有rarp协议报文返回，则证明该ip主机的网卡是混杂模式
5 使用实例：
实例1：显示网络设备信息（激活状态的）
命令：
ifconfig
输出：
eth0 Link encap:Ethernet HWaddr 00:50:56:BF:26:20
inet addr:192.168.120.204 Bcast:192.168.120.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:8700857 errors:0 dropped:0 overruns:0 frame:0
TX packets:31533 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:596390239 (568.7 MiB) TX bytes:2886956 (2.7 MiB)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:68 errors:0 dropped:0 overruns:0 frame:0
TX packets:68 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:2856 (2.7 KiB) TX bytes:2856 (2.7 KiB)
说明：
eth0 表示第一块网卡， 其中 HWaddr 表示网卡的物理地址，可以看到目前这个网卡的物理地址(MAC地址）是 00:50:56:BF:26:20
inet addr 用来表示网卡的IP地址，此网卡的 IP地址是 192.168.120.204，广播地址， Bcast:192.168.120.255，掩码地址Mask:255.255.255.0
lo 是表示主机的回坏地址，这个一般是用来测试一个网络程序，但又不想让局域网或外网的用户能够查看，只能在此台主机上运行和查看所用的网络接口。比如把 HTTPD服务器的指定到回坏地址，在浏览器输入 127.0.0.1 就能看到你所架WEB网站了。但只是您能看得到，局域网的其它主机或用户无从知道。
第一行：连接类型：Ethernet（以太网）HWaddr（硬件mac地址）
第二行：网卡的IP地址、子网、掩码
第三行：UP（代表网卡开启状态）RUNNING（代表网卡的网线被接上）MULTICAST（支持组播）MTU:1500（最大传输单元）：1500字节
第四、五行：接收、发送数据包情况统计
第七行：接收、发送数据字节数统计信息。
实例2：启动关闭指定网卡
命令：
ifconfig eth0 up
ifconfig eth0 down
输出：
说明：
ifconfig eth0 up 为启动网卡eth0 ；ifconfig eth0 down 为关闭网卡eth0。ssh登陆linux服务器操作要小心，关闭了就不能开启了，除非你有多网卡。
实例3：为网卡配置和删除IPv6地址
命令：
ifconfig eth0 add 33ffe:3240:800:1005::2/64
ifconfig eth0 del 33ffe:3240:800:1005::2/64
输出：
说明：
ifconfig eth0 add 33ffe:3240:800:1005::2/64 为网卡eth0配置IPv6地址；
ifconfig eth0 add 33ffe:3240:800:1005::2/64 为网卡eth0删除IPv6地址；
练习的时候，ssh登陆linux服务器操作要小心，关闭了就不能开启了，除非你有多网卡。
实例4：用ifconfig修改MAC地址
命令：
ifconfig eth0 hw ether 00:AA:BB:CC:DD:EE
输出：
[root@localhost ~]# ifconfig eth0 hw ether 00:AA:BB:CC:DD:EE //修改MAC地址
[root@localhost ~]# ifconfig eth0 up //启动网卡
[root@localhost ~]# ifconfig
eth0 Link encap:Ethernet HWaddr 00:AA:BB:CC:DD:EE
inet addr:192.168.120.204 Bcast:192.168.120.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:8700857 errors:0 dropped:0 overruns:0 frame:0
TX packets:31533 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:596390239 (568.7 MiB) TX bytes:2886956 (2.7 MiB)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:68 errors:0 dropped:0 overruns:0 frame:0
TX packets:68 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:2856 (2.7 KiB) TX bytes:2856 (2.7 KiB)
[root@localhost ~]# ifconfig eth0 hw ether 00:50:56:BF:26:20 //关闭网卡并修改MAC地址
[root@localhost ~]# ifconfig eth0 up //启动网卡
[root@localhost ~]# ifconfig
eth0 Link encap:Ethernet HWaddr 00:50:56:BF:26:20
inet addr:192.168.120.204 Bcast:192.168.120.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:8700857 errors:0 dropped:0 overruns:0 frame:0
TX packets:31533 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:596390239 (568.7 MiB) TX bytes:2886956 (2.7 MiB)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:68 errors:0 dropped:0 overruns:0 frame:0
TX packets:68 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:2856 (2.7 KiB) TX bytes:2856 (2.7 KiB)
说明：
实例5：配置IP地址
命令：
输出：
[root@localhost ~]# ifconfig eth0 192.168.120.56 netmask 255.255.255.0
[root@localhost ~]# ifconfig eth0 192.168.120.56 netmask 255.255.255.0 broadcast 192.168.120.255
说明：
ifconfig eth0 192.168.120.56
给eth0网卡配置IP地：192.168.120.56
ifconfig eth0 192.168.120.56 netmask 255.255.255.0
给eth0网卡配置IP地址：192.168.120.56 ，并加上子掩码：255.255.255.0
ifconfig eth0 192.168.120.56 netmask 255.255.255.0 broadcast 192.168.120.255
/给eth0网卡配置IP地址：192.168.120.56，加上子掩码：255.255.255.0，加上个广播地址： 192.168.120.255
实例6：启用和关闭ARP协议
命令：
ifconfig eth0 arp
ifconfig eth0 -arp
输出：
[root@localhost ~]# ifconfig eth0 -arp
说明：
ifconfig eth0 arp 开启网卡eth0 的arp协议；
ifconfig eth0 -arp 关闭网卡eth0 的arp协议；
实例7：设置最大传输单元
命令：
ifconfig eth0 mtu 1500
输出：
[root@localhost ~]# ifconfig
eth0 Link encap:Ethernet HWaddr 00:50:56:BF:26:1F
inet addr:192.168.120.203 Bcast:192.168.120.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1480 Metric:1
RX packets:8712395 errors:0 dropped:0 overruns:0 frame:0
TX packets:36631 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:597062089 (569.4 MiB) TX bytes:2643973 (2.5 MiB)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:9973 errors:0 dropped:0 overruns:0 frame:0
TX packets:9973 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:518096 (505.9 KiB) TX bytes:518096 (505.9 KiB)
[root@localhost ~]# ifconfig eth0 mtu 1500
[root@localhost ~]# ifconfig
eth0 Link encap:Ethernet HWaddr 00:50:56:BF:26:1F
inet addr:192.168.120.203 Bcast:192.168.120.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:8712548 errors:0 dropped:0 overruns:0 frame:0
TX packets:36685 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:597072333 (569.4 MiB) TX bytes:2650581 (2.5 MiB)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:9973 errors:0 dropped:0 overruns:0 frame:0
TX packets:9973 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:518096 (505.9 KiB) TX bytes:518096 (505.9 KiB)
[root@localhost ~]#
说明：
设置能通过的最大数据包大小为 1500 bytes
备注：用ifconfig命令配置的网卡信息，在网卡重启后机器重启后，配置就不存在。要想将上述的配置信息永远的存的电脑里，那就要修改网卡的配置文件。
1万+
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
