1

I have a question about network interface Promiscuous mode,

A NIC in promiscuous mode can receive all data passing through it regardless of whether the destination address of the data is it. If the NIC's working mode is set to "promiscuous mode" by the program, the NIC will accept all data frames flowing through it.

and if the interface is not in promiscuous mode, what't that mean? is it will check MAC address and drop rubbish packages and it will check IP address and drop rubbish packages?

but I think if the package is not to a Host's application, all will drop too.

what's the essence distinction between promiscuous mode and not promiscuous mode ?

and the other question is, we know there have many softwares which can capture packages, such as Wireshark, Sniffer, and tcpdump, where is the capture point? when a package comes into a NIC, where will the software capture it?

Let NIC promiscuous mode and not, why say this will impact the software's capture packages?

Improve this question

1 Answer 1

Reset to default
3

A NIC that is in normal operation = not in promiscuous mode drops all frames (in hardware) except those with its own address or the broadcast address as destination (or another, configured address). (This was designed for the early shared/repeated Ethernet where each frame went to all nodes in a collision domain.) Therefore, if you want to capture frames destined for another NIC you need to activate promiscuous mode.

So, if you just want to capture frames flowing through the NIC anyway you don't need promiscuous mode. If you use port mirroring on a switch (or a repeater hub) to direct 'alien' frames to the NIC you do need promiscuous mode.

Whether the frames transport IP (and the IP address matches) or anything else doesn't matter on the NIC level. IP destination addresses that are received by the NIC but that are not used on the host (nor broadcast/multicast) are dropped by the IP stack (in software). Essentially, capturing would work but usually they won't carry the NIC's destination address.

Most capturing tools interface with the driver directly. Basically, they're sitting between the driver and the OS.

Improve this answer
2
  • do you mean NIC will drop all frames (which do not destination to host itself) when the frame just into NIC in the promiscuous mode? so you mean the NIC will check the frame MAC address and IP address too?
    – aircraft
    Aug 28, 2019 at 11:30
  • The NIC only checks the destination MAC address in non-promiscuous mode. In promiscous mode it keeps all frames. Anything else including the IP address doesn't matter.
    – Zac67 ♦
    Aug 28, 2019 at 11:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.