This is our old Q&A Site. Please post any new questions and answers at

This is not a wireshark question but a general networking question. My machine running wireshark on the adapter in promiscuous mode sometimes receives frames destined for another machine on the subnet even though the network is fully switched, why?

my machine's mac address is :aa:bb:cc:xx:yy:zz, in promiscuous mode, no ip other machine's mac address is : aa:bb:cc:kk:ll:mm, ip: Internet server : ip:

Now why is my machine receiving some frames of the conversation between <-> even though the machines are connected to a switch? one reason could be that the switch did not know the mac address for and decided to flood all ports with the frame maybe ?


asked 16 Jan '14, 13:59

tushar's gravatar image

accept rate: 0%

The last sentence of your question is the answer. Switches "forget" learned MAC addresses every once in a while to allow them to be refreshed, and for that one packet will be flooded.

permanent link

answered 16 Jan '14, 14:06

Jasper's gravatar image

Jasper ♦♦
accept rate: 18%

Thank you Jasper!


(16 Jan '14, 15:01) tushar
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 16 Jan '14, 13:59

question was seen: 771 times

last updated: 16 Jan '14, 15:01

p​o​w​e​r​e​d by O​S​Q​A