mediumnetworkverified ✓

Ensure network interfaces are not in promiscuous mode

no-promiscuous-interfaces · RHEL ≥ 8 · 1 impl

Description

Network interfaces on RHEL 9 must not operate in promiscuous mode unless required for authorized network monitoring purposes.

Rationale

A network interface in promiscuous mode captures all network traffic on its segment, not just traffic destined for the host. This is a common technique used by attackers to eavesdrop on network communications and harvest credentials.

Check → Remediate

Checkcommand

# Check for any interface in PROMISC mode
promisc=$(ip link show 2>/dev/null | grep -i PROMISC | grep -v "^$")
if [ -z "$promisc" ]; then
  echo "OK: No network interfaces are in promiscuous mode"
  exit 0
fi
echo "FAIL: Interfaces in promiscuous mode: $promisc"
exit 1

expected_exit:: 0

Remediatemanual

note:: For each interface found in promiscuous mode, disable it: ip link set <interface> promisc off If the interface requires promiscuous mode for authorized monitoring, document the exception with the system's ISSM.

Framework references

STIG

V-281334 / RHEL-10-800020V-257941 / RHEL-09-251040V-230554

NIST 800-53

CM-7SC-7

Live verification

rhel8:checkrhel9:check

#network#promiscuous#eavesdropping#security