4

It's my understanding that if a network interface card (NIC) receives a Layer 1 packet, it will extract the Layer 2 frame from it, checks its destination MAC address, and if it is not addressed to it (or it's not a broadcast or multicast), it will drop it.

Is my understanding correct? If so, which component inside the NIC is responsible for this function? And is there a way to configure the NIC to not drop these frames and pass them through (e.g. for further analysis on Wireshark)?

1
  • Personally, for the purposes of network analysis via wireshark in these situations I prefer to use a port mirror or dedicated wireshark capture device. They can be had cheaply with USB interface and dump pcap files for you to analyze. I have never had much luck having consistent performance with promiscuous mode, especially if multiple virtualization layers are involved.
    – crasic
    Jan 17, 2019 at 23:02

3 Answers 3

7

The details of this are highly dependent on the hardware, but your description is correct: for many years now it is normally the network interface card which discards the frames which don't match the MAC address. This is an improvement from the old days, where every frame would interrupt the CPU which had to do this task.

In practice, every NIC can also be put into "promiscuous mode", where it will accept every frame. How this is done depends on the hardware, and therefore the operating system. If you're writing a program to do this in the manner of Wireshark, you'll find much help with the pcap library, but it's possible on Linux with raw sockets directly in promiscuous mode. All this would be a subject for https://stackoverflow.com/questions/tagged/pcap or https://stackoverflow.com/questions/tagged/promiscuous-mode

Additionally, most NIC hardware will accept other frames: broadcasts, "magic packets" for waking the CPU etc, and discard those with bad frame check sequence. The details are specific to each kind of NIC, but as an example, here are the facilities of one of the simplest ethernet interface chips, Microchip's ENC28J60, which describes its filters as follows:

8.0 RECEIVE FILTERS To minimize the processing requirements of the host controller, the ENC28J60 incorporates several different receive filters which can automatically reject packets which are not needed. Six different types of packet filters are implemented: Unicast, Pattern Match, Magic Packet, Hash Table, Multicast, Broadcast. (From datasheet.)

I'd have just called this rather generically the "receive filtering unit" or "receive filter process".

3

Is there a way to configure the NIC to not drop these frames and pass them through (e.g. for further analysis on Wireshark)?

Most NICs can be placed in "promiscuous" mode which will make them accept all frames, not just the ones addressed to it. The details depend on the NIC driver and operating system.

1
  • And, Wireshark normally does this automatically. There's a checkbox.
    – user253751
    Jan 17, 2019 at 21:52
1

Is my understanding correct?

Yes.

If so, which component inside the NIC is responsible for this function?

Not sure if it has a specific name.

And is there a way to configure the NIC to not drop these frames and pass them through (e.g. for further analysis on Wireshark)?

Yes, this is known as "promiscuous mode", packet capture tools will often enable this by default.

However note that modern Ethernet networks use Switches rather than hubs. So in most cases frames not addressed to your computer will not reach your computer's NIC at all.

1
  • Intelligent switches generally allow a port to be put into "monitor mode", which causes all frames to be forwarded to that port. You would do this on the port connected to the PC where you're running the packet capture.
    – Barmar
    Jan 17, 2019 at 17:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.