Path: utzoo!utgpu!watserv1!watmath!att!linac!uwm.edu!rpi!zaphod.mps.ohio-state.edu!wuarchive!csus.edu!ucdavis!pollux!ccruss
From: ccruss@pollux (Russ Hobby)
Newsgroups: comp.protocols.tcp-ip.ibmpc
Subject: Nasty NetCure side effect
Message-ID: <10608@aggie.ucdavis.edu>
Date: 20 Feb 91 22:54:16 GMT
Sender: usenet@aggie.ucdavis.edu
Reply-To: rdhobby@ucdavis.edu(Russ Hobby)
Organization: University of California, Davis
Lines: 29

I picked up NetCure (Netmon) and although it still seems to have a few
bugs to work out, it looks very nice.

However, I managed to break my network after using it. After playing
with Netmon and quiting, I started up KA9Q and went home. I leave KA9Q
running so that I can use my PC in my office as a PPP gateway. After I
left one of the other programmers noted that network was mostly broken
with multiple copies of each packet on the ethernet. He then traced it
to my PC, disconnected my PC from the ethernet and the problem when away.

I assume what happened was that Netmon left the packet driver in promiscuous
mode. When KA9Q was started it received all packets, not just the ones
addresssed to it on the ethernet. Since the IP packets were not for the
PC,  KA9Q then forwarded the packets back onto the ethernet. To make matters
worse the PC also received its own packets and forward those too. 
Fortunatly it would miss its own packet after a times and stop the chain.

I just wanted to warn others about this possibility.

Russ

                                Russell Hobby               
                         Data Communications Manager 
     U. C. Davis                 
     Computing Services      INTERNET: rdhobby@ucdavis.edu  
     Davis Ca 95616          BITNET:   RDHOBBY@UCDAVIS  
     (916) 752-0236          UUCP:     ...!ucbvax!ucdavis!rdhobby 

out onto the ethernet.