This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How can I test whether promiscuous mode is available and enabled on my adapter? Outside the obvious setting up a test setup and trying promiscuous capture.

Is there a command line that can tell me whether promiscuous capture is working OK?

I have plugged my laptop into the router, but I can't seem to capture any traffic oustide my own computer. I am not sure whether there is any ethernet switching happening on the router, so I need to make sure that promiscuous mode is working on my laptop first, before concluding that the switching is happening on the router.

Nothing looks off in Wireshark, the "use promiscuous mode on all adapters" is available and checked.

I use Wireshark on Windows.

asked 13 Sep '14, 07:55

Rolfen's gravatar image

Rolfen
11113
accept rate: 0%


I am not sure whether there is any ethernet switching happening on the router, so I need to make sure that promiscuous mode is working on my laptop first, before concluding that the switching is happening on the router.

The only way to experimentally determine whether promiscuous mode is working is to plug your computer into a non-switching hub, plug two other machines into that hub, have the other two machines exchange non-broadcast, non-multicast traffic, and run a capture program such as Wireshark and see whether it captures the traffic in question.

Most Ethernet adapters should support promiscuous mode, and Microsoft might require that Windows drivers for Ethernet adapters support turning promiscuous mode on in order to receive a "works with Windows" label from them, and WinPcap (which Wireshark uses on Windows) uses the standard NDIS programming interfaces for turning promiscuous mode on, so the problem is probably with the router.

Furthermore, it's probably easier to find out whether the router is at fault; find the documentation and see whether the port into which you plugged the laptop can be configured to have all traffic going through the router sent to it (this may be called "port mirroring" or a "SPAN port" or various other vendor-specific terms). If not, you're out of luck, promiscuous mode or not.

permanent link

answered 13 Sep '14, 14:21

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%

Thanks for the tips and information. Might be useful.

(13 Sep '14, 15:28) Rolfen
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×254
×87
×72
×43

question asked: 13 Sep '14, 07:55

question was seen: 18,157 times

last updated: 13 Sep '14, 15:28

p​o​w​e​r​e​d by O​S​Q​A