Solpromisc is a kernel module which you can load to detect attempts to put devices into promiscuous mode from user space via DLPI (e.g. solsniff, tcpdump, anything pcap based). It dumps the cred struct for the process, and the driver responsible, to the dmesg output buffer for collection by syslog. You are advised to read the source.
06ceaf80c902b59cb0e84800cc98a0d5632f16a49b3bf362b701a539753cd066