Update network_sniffer_disabled

linux_os/guide/system/network/network_sniffer_disabled/rule.yml

@@ -9,6 +9,8 @@ description: |-
     capture all traffic on the network to which it is connected. Run the following
     to determine if any interface is running in promiscuous mode:
     <pre>$ ip link | grep PROMISC</pre>
+    Promiscuous mode of an interface can be disabled with the following command:
+    <pre>$ sudo ip link set dev <tt>device_name</tt> multicast off promisc off</pre>
 
 rationale: |-
     Network interfaces in promiscuous mode allow for the capture of all network traffic
@@ -45,5 +47,6 @@ references:
 ocil_clause: 'any network device is in promiscuous mode'
 
 ocil: |-
-    Promiscuous mode of an interface can be disabled with the following command:
-    <pre>$ sudo ip link set dev <tt>device_name</tt> promisc off</pre>
+    To verify that Promiscuous mode of an interface is disabled, run the following command:
+    <pre>$ ip link | grep PROMISC</pre>
+    The output returned should not return any network device containing <tt>PROMISC</tt>.

linux_os/guide/system/network/network_sniffer_disabled/tests/no_promisc_interfaces.pass.sh

@@ -0,0 +1,5 @@
+#!/bin/bash
+
+for interface in $(ip link show | grep -i promisc | sed 's/^.*: \(.*\):.*$/\1/'); do
+  ip link set dev $interface promisc off
+done

linux_os/guide/system/network/network_sniffer_disabled/tests/promisc_interface_exists.fail.sh

@@ -0,0 +1,3 @@
+#!/bin/bash
+
+ip link set dev lo promisc on