[realtek] rtl8139 won't stay in promisc mode (Pcap_loop)

[Steve Doerr]

Hello.  I really hope someone hear can help me out with this apparently
uncommon situation.

I've got a firewall/router that I can't sniff any traffic on because
eth0 won't stay in promisc mode (it just toggles back and forth until
the error).

I see snort exit in my logs and the following error message:

pcap_loop: recvfrom: Network is down

I am running kernel 2.2.18pre21 on Debian, have an EfficientNetworks
SpeedStream 5660 DSL modem with dynamic ip service, and eth0 is a Phoebe
10/100 rtl 8139 that connects via dhcpcd.  I did run the diag program
here and everything seemed fine on the card.

I looked at pcap-linux.c in libpcap and saw the code below.  It seems to
have something to do with packet lengths.

The card won't stay in promisc mode even when set manually and these
packet problems are causing snort to exit.

Does anyone know if I should look to the card/driver, kernel, dsl
router, or libpcap to figure out why the software is gagging on these
packets?

Thanks very much for any input.
Steve

******from pcap-linux.c*************
/* Receive a single packet from the kernel */

 do {
  fromlen = sizeof(from);
  packet_len = recvfrom(
   handle->fd, handle->buffer + offset + handle->offset,
   handle->md.readlen - offset, MSG_TRUNC,
   (struct sockaddr *) &from, &fromlen);
 } while (packet_len == -1 && errno == EINTR);

 /* Check if an error occured */

 if (packet_len == -1) {
  if (errno == EAGAIN)
   return 0; /* no packet there */
  else {
   snprintf(handle->errbuf, sizeof(handle->errbuf),
     "recvfrom: %s", pcap_strerror(errno));
   return -1;
  }