#define WHO_NEEDS_NROFF_ANYWAY		/*	:-)	*/

You might try putting a printf/kprintf in the driver where the driver
enters/exits promiscuous mode such that it gets logged to the console
and/or syslog, and if you do it right, you should be able to get some
process accounting information on which PID is throwing the interface
into promiscuous mode.

Just a thought...


--
 ______________ ___   ________ _____WHO: Greywolf (unto death)
/ ___\ _ \ __\ V / \  / /__ \| | __/WHAT: UNIX System Mangler...er, Admin
\ \| |   < _| ` ' \ '` / \/ /|_| _/ WHERE: Ithaca SW,  1301 Marina Village Pkwy
 \___|_|\_\__\|_|  \/\/ \__/___/_|  Alameda, CA 94501 (415) 332-2344 x7255