asked on

IBM AIX : how to change the interface mode from PROMISC to SIMPLEX

en5: options=e080963<UP,BROADCAST,NOTRAILERS,RUNNING,PROMISC,SIMPLEX,MULTICAST,GROUPRT,64BIT>
inet 172.30.27.134 netmask 0xffffff80 broadcast 172.30.27.255
inet 172.30.27.137 netmask 0xffffff80 broadcast 172.30.27.255
inet 172.30.27.138 netmask 0xffffff80 broadcast 172.30.27.255
inet 172.30.27.139 netmask 0xffffff80 broadcast 172.30.27.255
inet 172.30.27.140 netmask 0xffffff80 broadcast 172.30.27.255
en6: options=e080863<UP,BROADCAST,NOTRAILERS,RUNNING,SIMPLEX,MULTICAST,GROUPRT,64BIT>
inet 172.30.21.134 netmask 0xffffff80 broadcast 172.30.21.255
inet 172.30.21.138 netmask 0xffffff80 broadcast 172.30.21.255
lo0: options=e08084b<UP,BROADCAST,LOOPBACK,RUNNING,SIMPLEX,MULTICAST,GROUPRT,64BIT>
inet 127.0.0.1 netmask 0xff000000 broadcast 127.255.255.255
inet6 ::1/0

for the interface en5 I need to change the mode PROMISC to SIMPLEX on an IBM AIX machine

How to do so ?

woolmilkporc

Hi,

seems that either an iptrace is running or wasn't stopped correctly. Try

ps -ef | grep iptrace

If it's there, stop it if you don't need it anymore. There are two different ways to do this, depending on how iptrace was started:

1) Check with lssrc -s iptrace whether it runs under control of SRC (status 'active' in the last column). If yes, stop it using stopsrc -s iptrace

2) If it's not under SRC, stop it using kill -15 [pid_of_iptrace]

If iptrace is not found in the process list, or if the above doesn't help removing the PROMISC flag, issue

iptrace -u

to unload the kernel extension that was loaded by the iptrace daemon at startup. At least this one should do the trick.

wmp

Ahmed ABDEL SALAM

ASKER

Thanks a lot woolmilkpor for your answer.

The issue was a little bit critical that's why I proceeded and I've restarted the server.

After Server restart the problem has been resolved.

woolmilkporc

OK then,

but I'd strongly advise you to try to figure out why and how that interface got into PROMISC mode!

Was iptrace started by intention and you just didn't know how to terminate it, or is there something yet inexplicable?

wmp

Ahmed ABDEL SALAM

ASKER

how to check in the past commands performed on IBM AIX ?

i.e. i need to check in the logs if this command was really launched or not

woolmilkporc

I assume that you don't use auditing and thus have little means to check.

Since one must be root to start iptrace you could check the .sh_history file in root's $HOME for commands.

If you suspect the use of 'su', check /var/adm/sulog, or if you suspect direct login, use last root to see where it came from.

wmp

Ahmed ABDEL SALAM

ASKER

Thanks wmp,

I will and get back to you tomorrow.

Ahmed ABDEL SALAM

ASKER

ifconfig en5 promisc .. I found someone ran this command from another side .. as I was working remotely on the server that's why it turned into PROMISC mode. !!

ASKER CERTIFIED SOLUTION

woolmilkporc

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

Ahmed ABDEL SALAM

ASKER

wmp,

It's quite an old version .. version 3 .. In fact if found the command ifconfig en5 promisc later after rebooting this machine as we have had another issue. I didn't know that someone applied the command ifconfig en5 promisc as someone was working remotely.

yes the command ifconfig en5 -promisc will definitely remove the ifconfig PROMISC

Anyway .. Thanks a lot for your contribution :-)

Ahmed ABDEL SALAM

ASKER

Thanks a lot