This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Capture all packets in promiscuous mode ?

0

What is the Golden Gate Bridge ? It's a bridge.

What does the check box "Capture all packets in promiscuous mode" do ? "This checkbox allows you to specify that Wireshark should put all interfaces in promiscuous mode when capturing".

So, what is promiscuous mode ?

asked 03 Feb '13, 11:18

wstest's gravatar image

wstest
1111
accept rate: 0%


One Answer:

1

Normally a network interface will only "receive" packets directly addressed to the interface. Promiscuous mode allows the interface to receive all packets that it sees whether they are addressed to the interface or not.

answered 03 Feb '13, 14:15

grahamb's gravatar image

grahamb ♦
19.8k330206
accept rate: 22%

or, to be more specific: when a network card is in promiscuous mode it accepts all packets, even if the destination MAC of the frame does not match it's own MAC. Broadcasts are accepted anyway. Without promiscuous mode frames with MACs other than the one the interface has are ignored (apart from broadcasts, again).

(03 Feb '13, 17:22) Jasper ♦♦

I could try to argue that broadcast packets are addressed to all interfaces, and thus fall within my woolly definition :-)

(04 Feb '13, 03:44) grahamb ♦