nerdexam
GIAC

GCFA · Question #197

You want to retrieve information whether your system is in promiscuous mode or not. Which of the following commands will you use? Each correct answer represents a complete solution. Choose all that…

The correct answer is A. grep Promisc /var/log/messages B. ip link C. ifconfig | grep PROMISC. On Linux, promiscuous mode can be detected using multiple commands that inspect interface flags or query system logs.

Advanced Mac & Linux Forensics

Question

You want to retrieve information whether your system is in promiscuous mode or not. Which of the following commands will you use? Each correct answer represents a complete solution. Choose all that apply.

Options

  • Agrep Promisc /var/log/messages
  • Bip link
  • Cifconfig | grep PROMISC
  • Dshow promisc

How the community answered

(27 responses)
  • A
    81% (22)
  • D
    19% (5)

Why each option

On Linux, promiscuous mode can be detected using multiple commands that inspect interface flags or query system logs.

Agrep Promisc /var/log/messagesCorrect

The kernel logs a message containing 'Promisc' in /var/log/messages when a network interface enters or exits promiscuous mode, making grep a valid detection method.

Bip linkCorrect

The 'ip link' command displays current interface state flags, and a PROMISC flag will appear in the output when an interface is in promiscuous mode.

Cifconfig | grep PROMISCCorrect

The ifconfig command includes the PROMISC flag in an interface's flag list when promiscuous mode is active, so piping through grep isolates that indicator.

Dshow promisc

'show promisc' is not a valid Linux shell command - it resembles Cisco IOS privileged-mode syntax and has no equivalent in standard Linux networking utilities.

Concept tested: Detecting promiscuous mode on Linux interfaces

Source: https://man7.org/linux/man-pages/man8/ip-link.8.html

Topics

#promiscuous mode#network forensics#Linux commands#ifconfig

Community Discussion

No community discussion yet for this question.

Full GCFA Practice