This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Promiscuous mode requirement for reading captured packet file?

0

I've been given a packet capture file that ran under promiscuous mode to monitor all traffic on a particular router. When I opened this file on my Windows machine, it only showed local capture data. But when I opened this file on other Linux machine, it shows all of the monitored traffic, including from other devices.

Does the machine you're opening a pre-captured file have to be setup as promiscuous mode in order to look at all of the traffic? Or is there some option that simply toggles this feature on?

asked 20 Apr '16, 23:00

capturebuddy's gravatar image

capturebuddy
6223
accept rate: 0%


One Answer:

0

Does the machine you're opening a pre-captured file have to be setup as promiscuous mode in order to look at all of the traffic?

No. Promiscuous mode is a capture mode; it has no effect on an existing capture. (Seriously. If it appears that it makes a difference, something else is happening.)

answered 20 Apr '16, 23:36

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%