Why a NIC in promiscuous mode and not will impact the capture packages?

Question

I have a question about network interface Promiscuous mode,

A NIC in promiscuous mode can receive all data passing through it regardless of whether the destination address of the data is it. If the NIC's working mode is set to "promiscuous mode" by the program, the NIC will accept all data frames flowing through it.

and if the interface is not in promiscuous mode, what't that mean? is it will check MAC address and drop rubbish packages and it will check IP address and drop rubbish packages?

but I think if the package is not to a Host's application, all will drop too.

what's the essence distinction between promiscuous mode and not promiscuous mode ?

and the other question is, we know there have many softwares which can capture packages, such as Wireshark, Sniffer, and tcpdump, where is the capture point? when a package comes into a NIC, where will the software capture it?

Let NIC promiscuous mode and not, why say this will impact the software's capture packages?

Answer 1

A NIC that is in normal operation = not in promiscuous mode drops all frames (in hardware) except those with its own address or the broadcast address as destination (or another, configured address). (This was designed for the early shared/repeated Ethernet where each frame went to all nodes in a collision domain.) Therefore, if you want to capture frames destined for another NIC you need to activate promiscuous mode.

So, if you just want to capture frames flowing through the NIC anyway you don't need promiscuous mode. If you use port mirroring on a switch (or a repeater hub) to direct 'alien' frames to the NIC you do need promiscuous mode.

Whether the frames transport IP (and the IP address matches) or anything else doesn't matter on the NIC level. IP destination addresses that are received by the NIC but that are not used on the host (nor broadcast/multicast) are dropped by the IP stack (in software). Essentially, capturing would work but usually they won't carry the NIC's destination address.

Most capturing tools interface with the driver directly. Basically, they're sitting between the driver and the OS.