Promiscuous Mode
Definition
A network interface operating mode in which the card passes all received frames to the capture software, not just frames addressed to its own MAC address. Required for packet capture on shared or mirrored segments. On switched networks, must be combined with a SPAN port or tap to receive non-local traffic.
- Field
- Network forensics, packet capture
- Function
- Passes all received frames to capture software
- Contrast
- Normal mode only accepts frames for its own MAC address
- Required for
- Full packet capture on shared or mirrored segments
- Switched network requirement
- SPAN port or tap needed alongside it
Common questions
Why isn't promiscuous mode alone enough to capture traffic on a modern switched network?+
A switch only forwards a frame out the port the destination device is connected to, so a capture device in promiscuous mode still only sees traffic addressed to it or broadcast to everyone, unless the switch is configured with a SPAN or mirror port, or a physical tap is inserted, to copy other ports' traffic to the capture point.
Does enabling promiscuous mode alter network traffic in a way that could affect evidence?+
No. It only changes what the local network interface passes up to the operating system and capture software; it does not modify, inject, or alter any frame on the wire, which is why it is considered a passive and forensically safe capture technique.
Can an attacker detect that a network card is running in promiscuous mode?+
Certain techniques, such as sending crafted ARP requests and observing unusual response behaviour, have historically been used to detect promiscuous interfaces on a segment, though modern operating systems and virtualised environments have made this detection less reliable than it once was.
Related terms
- BPF (Berkeley Packet Filter)
- A kernel-level packet filtering mechanism used by tcpdump, Wireshark, and most capture tools to select which packets are written to disk. BPF...
- Network Tap
- A hardware device inserted inline in a network cable path that passively copies the electrical or optical signal to one or more...
- JA3 / JA3S
- An MD5 fingerprint of the ordered fields of a TLS Client Hello (JA3) or Server Hello (JA3S). Allows identification of client software...
- Monitor Mode
- An 802.11 radio mode that captures every wireless frame in range, including management and control frames, without associating to an access point....
- PCAP / PCAPng
- The standard file formats for storing captured packets. PCAP (libpcap format) is the legacy standard supported by virtually all tools. PCAPng (Next...
- PCAPng
- PCAP Next Generation file format. Block-structured (SHB, IDB, EPB, ISB, DSB), supports multiple interfaces in one file, per-packet comments, name resolution, and...
- Ring Buffer Capture
- A capture mode in which the tool writes successive PCAP files of a fixed size or duration, overwriting the oldest when the...
- SPAN Port (Port Mirroring)
- A switch feature that copies frames from one or more source ports or VLANs to a designated destination port, where a capture...
Explained in these topics
- Live Packet Capture, Traffic Analysis and Deep Packet InspectionAn Ethernet NIC mode that accepts every frame on the segment, not only frames addressed to the host's MAC. Required for wired packet capture on a hub or a SPAN...
- Packet Capture Tools and Methods