Interface entered in promiscuous(sniffing) mode #11464

tomkolp · 2024-04-23T06:53:48Z

tomkolp
Apr 23, 2024

I use wazuh to protect my weblate server. The web interface of the weblate container has been in "promiscuous(sniffing) mode" for a month now. Previously, this message only appeared when starting weblate containers. Currently, it stays in this mode constantly after startup.
Is this expected behavior?

<html>
<body>
<!--StartFragment-->
@timestamp | 2024-04-23T06:45:41.100Z
-- | --
  | _id | h-20CY8B9_7vSdNjHLUs
  | agent.id | 004
  | agent.ip | xxx.xxx.xxx.xxx
  | agent.name | weblate
  | data.aws.accountId |  
  | data.aws.region |  
  | decoder.name | kernel
  | full_log | Apr 23 06:45:40 weblate kernel: [565221.034790] device vetha0c1b6d entered promiscuous mode
  | id | 1713854741.2204930
  | input.type | log
  | location | /var/log/kern.log
  | manager.name | wazuh.manager
  | predecoder.hostname | weblate
  | predecoder.program_name | kernel
  | predecoder.timestamp | Apr 23 06:45:40
  | rule.description | Interface entered in promiscuous(sniffing) mode.
  | rule.firedtimes | 98
  | rule.gdpr | IV_35.7.d
  | rule.gpg13 | 4.13
  | rule.groups | syslog, linuxkernel, promisc
  | rule.hipaa | 164.312.b
  | rule.id | 5104
  | rule.level | 8
  | rule.mail | false
  | rule.mitre.id | T1040
  | rule.mitre.tactic | Credential Access, Discovery
  | rule.mitre.technique | Network Sniffing
  | rule.nist_800_53 | AU.6, SI.4
  | rule.pci_dss | 10.6.1, 11.4
  | rule.tsc | CC7.2, CC7.3, CC6.1, CC6.8
  | timestamp | 2024-04-23T06:45:41.100+0000

<!--EndFragment-->
</body>
</html>

Answered by nijel

Apr 23, 2024

I doubt that Weblate itself influences this, this is purely handled by the Docker engine.

View full answer

nijel · 2024-04-23T09:19:09Z

nijel
Apr 23, 2024
Maintainer

Docker does that when creating a network, I'm not sure if there is a way to avoid that.

2 replies

tomkolp Apr 23, 2024
Author

Yes I know about it. The thing is that over a month ago, after the network was created, the interface was returning to normal. Currently, it is still in "promiscuous(sniffing) mode". I don't know if something has changed in the weblate itself or in my system. If it does not affect security, I will simply ignore it, but I am curious why there is such a change.

nijel Apr 23, 2024
Maintainer

I doubt that Weblate itself influences this, this is purely handled by the Docker engine.

Answer selected by tomkolp

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Interface entered in promiscuous(sniffing) mode #11464

{{title}}

Replies: 1 comment 2 replies

{{title}}

{{title}}

{{title}}

Select a reply

Interface entered in promiscuous(sniffing) mode #11464

tomkolp Apr 23, 2024

Replies: 1 comment · 2 replies

nijel Apr 23, 2024 Maintainer

tomkolp Apr 23, 2024 Author

nijel Apr 23, 2024 Maintainer

tomkolp
Apr 23, 2024

Replies: 1 comment 2 replies

nijel
Apr 23, 2024
Maintainer

tomkolp Apr 23, 2024
Author

nijel Apr 23, 2024
Maintainer