I've been given a packet capture file that ran under promiscuous mode to monitor all traffic on a particular router. When I opened this file on my Windows machine, it only showed local capture data. But when I opened this file on other Linux machine, it shows all of the monitored traffic, including from other devices. Does the machine you're opening a pre-captured file have to be setup as promiscuous mode in order to look at all of the traffic? Or is there some option that simply toggles this feature on? asked 20 Apr '16, 23:00  capturebuddy |
One Answer:
No. Promiscuous mode is a capture mode; it has no effect on an existing capture. (Seriously. If it appears that it makes a difference, something else is happening.) answered 20 Apr '16, 23:36  Guy Harris ♦♦ |
