1使用ifconfig命令可查看当前网卡是否设置为混杂模式
[zhaihf@localhost~]$ ifconfigeth0 Linkencap:Ethernet HWaddr 00:16:31:FF:A6:2Einet addr:192.168.9.1 Bcast:192.168.9.255Mask:255.255.255.0UPBROADCAST MULTICASTMTU:1500 Metric:1RX packets:0 errors:0 dropped:0 overruns:0 frame:0TX packets:0 errors:0 dropped:0 overruns:0 carrier:0collisions:0 txqueuelen:1000RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)Memory:98420000-98440000
eth1Link encap:Ethernet HWaddr 00:16:31:FF:A6:2Finet addr:192.168.8.48 Bcast:192.168.8.255Mask:255.255.255.0inet6 addr: fe80::216:31ff:feff:a61f/64 Scope:LinkUPBROADCAST RUNNING PROMISC MULTICASTMTU:1500 Metric:1RX packets:28011022 errors:0 dropped:0 overruns:0 frame:0TX packets:18408510 errors:0 dropped:0 overruns:0 carrier:0collisions:0 txqueuelen:1000RX bytes:31733322503 (29.5 GiB) TX bytes:21092798216 (19.6GiB)Memory:98400000-98420000
loLink encap:Local Loopbackinet addr:127.0.0.1 Mask:255.0.0.0inet6 addr: ::1/128 Scope:HostUP LOOPBACK RUNNING MTU:16436 Metric:1RX packets:8873 errors:0 dropped:0 overruns:0 frame:0TX packets:8873 errors:0 dropped:0 overruns:0 carrier:0collisions:0 txqueuelen:0RX bytes:3140421 (2.9 MiB) TX bytes:3140421 (2.9 MiB)
usb0Link encap:Ethernet HWaddr 5E:F3:FC:E1:D2:19inet addr:169.254.95.120 Bcast:169.254.95.255Mask:255.255.255.0inet6 addr: fe80::5cf3:fcff:fee1:d217/64 Scope:LinkUP BROADCAST RUNNING MULTICAST MTU:1500Metric:1 RXpackets:220031 errors:0 dropped:0 overruns:0 frame:0TX packets:110230 errors:0 dropped:0 overruns:0 carrier:0collisions:0 txqueuelen:1000RX bytes:14862206 (14.1 MiB) TX bytes:5251125 (5.0 MiB)
其中UPBROADCAST RUNNING PROMISC MULTICAST的PROMISC说明网卡eth1已经设置成混杂模式。
字段含义说明：eth0/eth1: 分别表示第一块网卡和第二块网卡；lo: 表示回环测试接口，注意，这个虚拟的interface一定要存在！usb0: 表示USB接口的网卡；Linkencap: 表示位于OSI物理层的名称，即连接类型Ethernet（以太网）HWaddr: 表示网卡的硬件地址，即MAC地址inetaddr: 表示网卡IP；Bcast: 表示广播(broadcast ) 的地址；Mask: 表示子网掩码；UP: 表示网卡开启状态；BROADCAST: 表示支持广播；MULTICAST: 表示网卡混杂模式；RUNNING: 表示网卡的网线被接上；MULTICAST: 表示支持组播；MTU: 表示MaximumTrasmission Unit 最大传输单元(字节)，即此接口一次所能传输的最大封包；Metric: 表示路由度量值，缺省值是0；RX: 表示网络由激活到目前为止接收的数据包；TX: 表示网络由激活到目前为止发送的数据包；collisions: 表示网络信号冲突的情况；txqueuelen: 表示传输缓冲区长度大小；Memory: 表示占用内存范围。
2设置混杂模式
[zhaihf@localhost~]$ifconfigeth1 promisc
3命令
3.1help[zhaihf@localhost~]$ifconfig –helpUsage:ifconfig[-a] [-v] [-s] <interface> [[<AF>] <address>][add<address>[/<prefixlen>]][del<address>[/<prefixlen>]][[-]broadcast[<address>]] [[-]pointopoint [<address>]][netmask<address>] [dstaddr <address>] [tunnel <address>][outfill<NN>] [keepalive <NN>][hw<HW> <address>] [metric <NN>] [mtu <NN>][[-]trailers] [[-]arp] [[-]allmulti][multicast] [[-]promisc][mem_start<NN>] [io_addr <NN>] [irq <NN>] [media <type>][txqueuelen<NN>][[-]dynamic][up|down]…<HW>=HardwareType.Listof possible hardware types:loop(Local Loopback) slip (Serial Line IP) cslip (VJ Serial Line IP)slip6(6-bit Serial Line IP) cslip6 (VJ 6-bit Serial Line IP) adaptive(Adaptive Serial Line IP)strip(Metricom Starmode IP) ash (Ash) ether (Ethernet)tr(16/4 Mbps Token Ring) tr (16/4 Mbps Token Ring (New)) ax25 (AMPRAX.25)netrom(AMPR NET/ROM) rose (AMPR ROSE) tunnel (IPIP Tunnel)ppp(Point-to-Point Protocol) hdlc ((Cisco)-HDLC) lapb (LAPB)arcnet(ARCnet) dlci (Frame Relay DLCI) frad (Frame Relay Access Device)sit(IPv6-in-IPv4) fddi (Fiber Distributed Data Interface) hippi (HIPPI)irda(IrLAP) ec (Econet) x25 (generic X.25)infiniband(InfiniBand)<AF>=Addressfamily. Default: inetListof possible address families:unix(UNIX Domain) inet (DARPA Internet) inet6 (IPv6)ax25(AMPR AX.25) netrom (AMPR NET/ROM) rose (AMPR ROSE)ipx(Novell IPX) ddp (Appletalk DDP) ec (Econet)ash(Ash) x25 (CCITT X.25)2.2man ifconfigNAMEifconfig- configure a network interfaceSYNOPSISifconfig[interface]ifconfiginterface [aftype] options | address …DESCRIPTIONIfconfig is used to configure the kernel-resident network interfaces.Itis used at boot time to set up interfaces as necessary. After that,it is usually only needed when debugging or when system tuning isneeded.Ifno arguments are given, ifconfig displays the status of the cur-rently active interfaces. If a single interface argument is given, itdisplaysthe status of the given interface only; if a single -a argu-ment is given, it displays the status of all interfaces, even thosethatare down. Otherwise, it configures an interface.AddressFamiliesIfthe first argument after the interface name is recognized as thename of a supported address family, that address family is used fordecodingand displaying all protocol addresses. Currently supportedaddress families include inet (TCP/IP, default), inet6 (IPv6), ax25(AMPRPacket Radio), ddp (Appletalk Phase 2), ipx (Novell IPX) andnetrom(AMPR Packet radio). All numbers supplied as parts in IPv4 dot-teddecimal notation may be decimal, octal, or hexadecimal, as speci-fied in the ISO C standard (that is, a leading 0x or 0X implies hex-adecimal;otherwise, a leading ’0’ implies octal; otherwise, the numberis interpreted as decimal). Use of hexamedial and octal numbers is notRFC-compliantand therefore its use is discouraged and may go away.OPTIONSinterfaceThename of the interface. This is usually a driver name fol-lowed by a unit number, for example eth0 for the first Ethernetinterface.up This flag causes the interface to be activated. It is implic-itlyspecified if an address is assigned to the interface.down This flag causes the driver for this interface to be shut down.[-]arpEnable or disable the use of the ARP protocol on this interface.[-]promiscEnable or disable the promiscuous mode of the interface. Ifselected,all packets on the network will be received by theinterface.[-]allmultiEnable or disable all-multicast mode. If selected, all multi-castpackets on the network will be received by the interface.metricNThisparameter sets the interface metric.mtuN This parameter sets the Maximum Transfer Unit (MTU) of an inter-face.dstaddraddrSet the remote IP address for a point-to-point link (such asPPP). This keyword is now obsolete; use the pointopoint keywordinstead.netmaskaddrSetthe IP network mask for this interface. This value defaultstothe usual class A, B or C network mask (as derived from theinterfaceIP address), but it can be set to any value.addaddr/prefixlenAddan IPv6 address to an interface.deladdr/prefixlenRemovean IPv6 address from an interface.tunnel::aa.bb.cc.ddCreate a new SIT (IPv6-in-IPv4) device, tunnelling to the givendestination.irqaddrSetthe interrupt line used by this device. Not all devices candynamicallychange their IRQ setting.io_addraddrSetthe start address in I/O space for this device.mem_startaddrSet the start address for shared memory used by this device.Onlya few devices need this.mediatypeSetthe physical port or medium type to be used by the device.Notall devices can change this setting, and those that can varyinwhat values they support. Typical values for type are10base2(thin Ethernet), 10baseT (twisted-pair 10Mbps Ethernet),AUI(external transceiver) and so on. The special medium typeof auto can be used to tell the driver to auto-sense the media.Again,not all drivers can do this.[-]broadcast[addr]Ifthe address argument is given, set the protocol broadcastaddress for this interface. Otherwise, set (or clear) theIFF_BROADCASTflag for the interface.[-]pointopoint[addr]Thiskeyword enables the point-to-point mode of an interface,meaning that it is a direct link between two machines withnobodyelse listening on it.Ifthe address argument is also given, set the protocol addressof the other side of the link, just like the obsolete dstaddrkeyworddoes. Otherwise, set or clear the IFF_POINTOPOINT flagforthe interface.hwclass addressSetthe hardware address of this interface, if the device driversupportsthis operation. The keyword must be followed by thenameof the hardware class and the printable ASCII equivalent ofthehardware address. Hardware classes currently supportedinclude ether (Ethernet), ax25 (AMPR AX.25), ARCnet and netrom(AMPRNET/ROM).multicastSetthe multicast flag on the interface. This should not nor-mally be needed as the drivers set the flag correctly them-selves.addressTheIP address to be assigned to this interface.txqueuelenlengthSetthe length of the transmit queue of the device. It is usefulto set this to small values for slower devices with a highlatency(modem links, ISDN) to prevent fast bulk transfers fromdisturbinginteractive traffic like telnet too much.NOTESSincekernel release 2.2 there are no explicit interface statistics foraliasinterfaces anymore. The statistics printed for the originaladdress are shared with all alias addresses on the same device. If youwantper-address statistics you should add explicit accounting rulesforthe address using the ipchains(8) command.Interrupt problems with Ethernet device drivers fail with EAGAIN. Seehttp://www.scyld.com/expert/irq-conflict.htmlfor more information.FILES/proc/net/socket/proc/net/dev/proc/net/if_inet6BUGSWhileappletalk DDP and IPX addresses will be displayed they cannot bealteredby this command.SEEALSOroute(8),netstat(8), arp(8), rarp(8), ipchains(8)
4 其它方法
4.1 arp
使用arp协议，向指定怀疑的ip主机发送arp协议报文，如果有rarp协议报文返回，则证明该ip主机的网卡是混杂模式
5 使用实例：
实例1：显示网络设备信息（激活状态的）
命令：
ifconfig
输出：
[root@localhost~]#ifconfigeth0Linkencap:EthernetHWaddr00:50:56:BF:26:20inetaddr:192.168.120.204Bcast:192.168.120.255Mask:255.255.255.0UPBROADCASTRUNNINGMULTICASTMTU:1500Metric:1RXpackets:8700857errors:0dropped:0overruns:0frame:0TXpackets:31533errors:0dropped:0overruns:0carrier:0collisions:0txqueuelen:1000RXbytes:596390239(568.7MiB)TXbytes:2886956(2.7MiB)loLinkencap:LocalLoopbackinetaddr:127.0.0.1Mask:255.0.0.0UPLOOPBACKRUNNINGMTU:16436Metric:1RXpackets:68errors:0dropped:0overruns:0frame:0TXpackets:68errors:0dropped:0overruns:0carrier:0collisions:0txqueuelen:0RXbytes:2856(2.7KiB)TXbytes:2856(2.7KiB)
说明：
eth0表示第一块网卡，其中HWaddr表示网卡的物理地址，可以看到目前这个网卡的物理地址(MAC地址）是00:50:56:BF:26:20
inetaddr用来表示网卡的IP地址，此网卡的IP地址是192.168.120.204，广播地址，Bcast:192.168.120.255，掩码地址Mask:255.255.255.0
lo是表示主机的回坏地址，这个一般是用来测试一个网络程序，但又不想让局域网或外网的用户能够查看，只能在此台主机上运行和查看所用的网络接口。比如把HTTPD服务器的指定到回坏地址，在浏览器输入127.0.0.1就能看到你所架WEB网站了。但只是您能看得到，局域网的其它主机或用户无从知道。
第一行：连接类型：Ethernet（以太网）HWaddr（硬件mac地址）
第二行：网卡的IP地址、子网、掩码
第三行：UP（代表网卡开启状态）RUNNING（代表网卡的网线被接上）MULTICAST（支持组播）MTU:1500（最大传输单元）：1500字节
第四、五行：接收、发送数据包情况统计
第七行：接收、发送数据字节数统计信息。
实例2：启动关闭指定网卡
命令：
ifconfigeth0up
ifconfigeth0down
输出：
说明：
ifconfigeth0up为启动网卡eth0；ifconfigeth0down为关闭网卡eth0。ssh登陆linux服务器操作要小心，关闭了就不能开启了，除非你有多网卡。
实例3：为网卡配置和删除IPv6地址
命令：
ifconfigeth0add33ffe:3240:800:1005::2/64
ifconfigeth0del33ffe:3240:800:1005::2/64
输出：
说明：
ifconfigeth0add33ffe:3240:800:1005::2/64为网卡eth0配置IPv6地址；
ifconfigeth0add33ffe:3240:800:1005::2/64为网卡eth0删除IPv6地址；
练习的时候，ssh登陆linux服务器操作要小心，关闭了就不能开启了，除非你有多网卡。
实例4：用ifconfig修改MAC地址
命令：
ifconfigeth0hwether00:AA:BB:CC:DD:EE
输出：
[root@localhost~]#ifconfigeth0down//关闭网卡[root@localhost~]#ifconfigeth0hwether00:AA:BB:CC:DD:EE//修改MAC地址[root@localhost~]#ifconfigeth0up//启动网卡[root@localhost~]#ifconfigeth0Linkencap:EthernetHWaddr00:AA:BB:CC:DD:EEinetaddr:192.168.120.204Bcast:192.168.120.255Mask:255.255.255.0UPBROADCASTRUNNINGMULTICASTMTU:1500Metric:1RXpackets:8700857errors:0dropped:0overruns:0frame:0TXpackets:31533errors:0dropped:0overruns:0carrier:0collisions:0txqueuelen:1000RXbytes:596390239(568.7MiB)TXbytes:2886956(2.7MiB)loLinkencap:LocalLoopbackinetaddr:127.0.0.1Mask:255.0.0.0UPLOOPBACKRUNNINGMTU:16436Metric:1RXpackets:68errors:0dropped:0overruns:0frame:0TXpackets:68errors:0dropped:0overruns:0carrier:0collisions:0txqueuelen:0RXbytes:2856(2.7KiB)TXbytes:2856(2.7KiB)[root@localhost~]#ifconfigeth0hwether00:50:56:BF:26:20//关闭网卡并修改MAC地址[root@localhost~]#ifconfigeth0up//启动网卡[root@localhost~]#ifconfigeth0Linkencap:EthernetHWaddr00:50:56:BF:26:20inetaddr:192.168.120.204Bcast:192.168.120.255Mask:255.255.255.0UPBROADCASTRUNNINGMULTICASTMTU:1500Metric:1RXpackets:8700857errors:0dropped:0overruns:0frame:0TXpackets:31533errors:0dropped:0overruns:0carrier:0collisions:0txqueuelen:1000RXbytes:596390239(568.7MiB)TXbytes:2886956(2.7MiB)loLinkencap:LocalLoopbackinetaddr:127.0.0.1Mask:255.0.0.0UPLOOPBACKRUNNINGMTU:16436Metric:1RXpackets:68errors:0dropped:0overruns:0frame:0TXpackets:68errors:0dropped:0overruns:0carrier:0collisions:0txqueuelen:0RXbytes:2856(2.7KiB)TXbytes:2856(2.7KiB)
说明：
实例5：配置IP地址
命令：
输出：
[root@localhost~]#ifconfigeth0192.168.120.56[root@localhost~]#ifconfigeth0192.168.120.56netmask255.255.255.0[root@localhost~]#ifconfigeth0192.168.120.56netmask255.255.255.0broadcast192.168.120.255
说明：
ifconfigeth0192.168.120.56
给eth0网卡配置IP地：192.168.120.56
ifconfigeth0192.168.120.56netmask255.255.255.0
给eth0网卡配置IP地址：192.168.120.56，并加上子掩码：255.255.255.0
ifconfigeth0192.168.120.56netmask255.255.255.0broadcast192.168.120.255
/给eth0网卡配置IP地址：192.168.120.56，加上子掩码：255.255.255.0，加上个广播地址：192.168.120.255
实例6：启用和关闭ARP协议
命令：
ifconfigeth0arp
ifconfigeth0-arp
输出：
[root@localhost~]#ifconfigeth0arp[root@localhost~]#ifconfigeth0-arp
说明：
ifconfigeth0arp开启网卡eth0的arp协议；
ifconfigeth0-arp关闭网卡eth0的arp协议；
实例7：设置最大传输单元
命令：
ifconfigeth0mtu1500
输出：
[root@localhost~]#ifconfigeth0mtu1480[root@localhost~]#ifconfigeth0Linkencap:EthernetHWaddr00:50:56:BF:26:1Finetaddr:192.168.120.203Bcast:192.168.120.255Mask:255.255.255.0UPBROADCASTRUNNINGMULTICASTMTU:1480Metric:1RXpackets:8712395errors:0dropped:0overruns:0frame:0TXpackets:36631errors:0dropped:0overruns:0carrier:0collisions:0txqueuelen:1000RXbytes:597062089(569.4MiB)TXbytes:2643973(2.5MiB)loLinkencap:LocalLoopbackinetaddr:127.0.0.1Mask:255.0.0.0UPLOOPBACKRUNNINGMTU:16436Metric:1RXpackets:9973errors:0dropped:0overruns:0frame:0TXpackets:9973errors:0dropped:0overruns:0carrier:0collisions:0txqueuelen:0RXbytes:518096(505.9KiB)TXbytes:518096(505.9KiB)[root@localhost~]#ifconfigeth0mtu1500[root@localhost~]#ifconfigeth0Linkencap:EthernetHWaddr00:50:56:BF:26:1Finetaddr:192.168.120.203Bcast:192.168.120.255Mask:255.255.255.0UPBROADCASTRUNNINGMULTICASTMTU:1500Metric:1RXpackets:8712548errors:0dropped:0overruns:0frame:0TXpackets:36685errors:0dropped:0overruns:0carrier:0collisions:0txqueuelen:1000RXbytes:597072333(569.4MiB)TXbytes:2650581(2.5MiB)loLinkencap:LocalLoopbackinetaddr:127.0.0.1Mask:255.0.0.0UPLOOPBACKRUNNINGMTU:16436Metric:1RXpackets:9973errors:0dropped:0overruns:0frame:0TXpackets:9973errors:0dropped:0overruns:0carrier:0collisions:0txqueuelen:0RXbytes:518096(505.9KiB)TXbytes:518096(505.9KiB)[root@localhost~]#
说明：
设置能通过的最大数据包大小为1500bytes
备注：用ifconfig命令配置的网卡信息，在网卡重启后机器重启后，配置就不存在。要想将上述的配置信息永远的存的电脑里，那就要修改网卡的配置文件。
年轻是胜利的一半。
