Promiscuous Mode Clarifications

The following definitions are being defined for the various levels of promiscuous mode.

DL_PROMISC_PHYS—If enabled before the STREAM has been bound (with the DL_BIND_REQ primitive), the DLPI user receives all traffic on the wire regardless of SAP or address. If enabled after the STREAM has been bound, the DLPI user receives all traffic on the wire that matches the protocol(s) the user has bound to on the promiscuous STREAM. This includes protocols bound with the DL_SUBS_BIND_REQ.

DL_PROMISC_SAP—If enabled before the STREAM has been bound (with the DL_BIND_REQ primitive), the DLPI user receives all traffic destined for this interface (physical addresses, broadcast addresses or bound multicast addresses) that matches any SAP enabled on that interface. If enabled after the STREAM has been bound, the DLPI user receives only those packets originally destined for the interface that match one of the protocol(s) bound on the promiscuous STREAM.

DL_PROMISC_MULTI—Before the STREAM has been bound (with the DL_BIND_REQ primitive), the DLPI user receives all multicast packets on the wire regardless of the SAP. After the STREAM has been bound, the DLPI user receives all multicast packets that match one of the protocol(s) bound on the promiscuous STREAM.

Security Containment

With the Security Containment product version B.11.23.01 or later, HP DLPI will allow enabling and disabling of promiscuous mode only for users with the PRIV_NETPROMISCUOUS privilege.

See “Fine-grained Privileges with Security Containment Release” for more details.

	NOTE: Each LAN interface currently allows only one unbound stream to enable the promiscuous mode service.