Hi all,

A vulnerability scanner unearthed that my Unraid server interfaces are in promiscuous mode without being configured to be.

I can see in my logs that the interfaces enter the mode every time after the trim runs and from the log time it coincides with my scheduled mover but why and how do they enter prom mode?

Neither in my network.cfg nor if I check my running ifconfig is any setting done to enter promiscuous mode, but yet they are in the log and vulnerability scanners do see them as in this mode.

Does anyone know where this setting could come from so I can deactivate it?

See below one of the log entires:

Feb  2 03:00:11 UNRAID root: /mnt/cache: 13.8 GiB (14853738496 bytes) trimmed on /dev/nvme0n1p1
Feb  2 03:00:11 UNRAID root: /var/lib/docker: 7 GiB (7534891008 bytes) trimmed on /dev/loop2
Feb  2 03:00:12 UNRAID root: /var/lib/docker/btrfs: 7 GiB (7536017408 bytes) trimmed on /dev/loop2[/btrfs]
Feb  2 03:00:16 UNRAID kernel: br0.10: left promiscuous mode
Feb  2 03:00:16 UNRAID kernel: veth88ed50a: renamed from eth0
Feb  2 03:07:30 UNRAID kernel: eth0: renamed from veth37a692d
Feb  2 03:07:30 UNRAID kernel: br0.10: entered promiscuous mode
Feb  2 03:07:36 UNRAID kernel: br0.120: left promiscuous mode
Feb  2 03:07:36 UNRAID kernel: veth4350ea6: renamed from eth0
Feb  2 03:15:50 UNRAID kernel: eth0: renamed from veth8b86f27
Feb  2 03:15:50 UNRAID kernel: br0.120: entered promiscuous mode
Feb  2 03:15:53 UNRAID kernel: br0.110: left promiscuous mode
Feb  2 03:15:53 UNRAID kernel: veth32a67ac: renamed from eth0
Feb  2 03:16:11 UNRAID kernel: eth0: renamed from veth4431daa
Feb  2 03:16:11 UNRAID kernel: br0.110: entered promiscuous mode
Feb  2 03:18:42 UNRAID crond[3343]: exit status 1 from user root php /usr/local/emhttp/plugins/appdata.backup/scripts/backup.php > /dev/null 2>&1

Does it happen in SAFE mode?

Attach Diagnostics ZIP to your NEXT post in this thread.