How can I test whether promiscuous mode is available and enabled on my adapter? Outside the obvious setting up a test setup and trying promiscuous capture.
Is there a command line that can tell me whether promiscuous capture is working OK?
I have plugged my laptop into the router, but I can't seem to capture any traffic oustide my own computer. I am not sure whether there is any ethernet switching happening on the router, so I need to make sure that promiscuous mode is working on my laptop first, before concluding that the switching is happening on the router.
Nothing looks off in Wireshark, the "use promiscuous mode on all adapters" is available and checked.
I use Wireshark on Windows.
asked 13 Sep '14, 07:55
The only way to experimentally determine whether promiscuous mode is working is to plug your computer into a non-switching hub, plug two other machines into that hub, have the other two machines exchange non-broadcast, non-multicast traffic, and run a capture program such as Wireshark and see whether it captures the traffic in question.
Most Ethernet adapters should support promiscuous mode, and Microsoft might require that Windows drivers for Ethernet adapters support turning promiscuous mode on in order to receive a "works with Windows" label from them, and WinPcap (which Wireshark uses on Windows) uses the standard NDIS programming interfaces for turning promiscuous mode on, so the problem is probably with the router.
Furthermore, it's probably easier to find out whether the router is at fault; find the documentation and see whether the port into which you plugged the laptop can be configured to have all traffic going through the router sent to it (this may be called "port mirroring" or a "SPAN port" or various other vendor-specific terms). If not, you're out of luck, promiscuous mode or not.
answered 13 Sep '14, 14:21
Guy Harris ♦♦