computer networking A computer network is a set of computers sharing resources located on or provided by network nodes. The computers use common communication protocols over digital interconnections to communicate with each other. These interconnections ar ...

, promiscuous mode is a mode for a wired network interface controller (NIC) or wireless network interface controller (WNIC) that causes the controller to pass all traffic it receives to the

central processing unit A central processing unit (CPU), also called a central processor, main processor or just processor, is the electronic circuitry that executes instructions comprising a computer program. The CPU performs basic arithmetic, logic, controlling, an ...

(CPU) rather than passing only the frames that the controller is specifically programmed to receive. This mode is normally used for packet sniffing that takes place on a router or on a computer connected to a wired network or one being part of a

wireless LAN A wireless LAN (WLAN) is a wireless computer network that links two or more devices using wireless communication to form a local area network (LAN) within a limited area such as a home, school, computer laboratory, campus, or office building ...

. Interfaces are placed into promiscuous mode by software bridges often used with hardware virtualization. In IEEE 802 networks such as

Ethernet Ethernet () is a family of wired computer networking technologies commonly used in local area networks (LAN), metropolitan area networks (MAN) and wide area networks (WAN). It was commercially introduced in 1980 and first standardized in ...

or IEEE 802.11, each frame includes a destination MAC address. In non-promiscuous mode, when a NIC receives a frame, it drops it unless the frame is addressed to that NIC's MAC address or is a

broadcast Broadcasting is the distribution (business), distribution of sound, audio or video content to a dispersed audience via any electronic medium (communication), mass communications medium, but typically one using the electromagnetic spectrum (radio ...

or multicast addressed frame. In promiscuous mode, however, the NIC allows all frames through, thus allowing the computer to read frames intended for other machines or network devices. Many

operating system An operating system (OS) is system software that manages computer hardware, software resources, and provides common daemon (computing), services for computer programs. Time-sharing operating systems scheduler (computing), schedule tasks for ef ...

s require superuser privileges to enable promiscuous mode. A non-routing node in promiscuous mode can generally only monitor traffic to and from other nodes within the same broadcast domain (for Ethernet and IEEE 802.11) or ring (for Token Ring). Computers attached to the same Ethernet hub satisfy this requirement, which is why network switches are used to combat malicious use of promiscuous mode. A router may monitor all traffic that it routes. Promiscuous mode is often used to diagnose network connectivity issues. There are programs that make use of this feature to show the user all the data being transferred over the network. Some protocols like FTP and Telnet transfer data and passwords in clear text, without encryption, and network scanners can see this data. Therefore, computer users are encouraged to stay away from insecure protocols like telnet and use more secure ones such as SSH.

Detection

As promiscuous mode can be used in a malicious way to capture private data in transit on a network, computer security professionals might be interested in detecting network devices that are in promiscuous mode. In promiscuous mode, some software might send responses to frames even though they were addressed to another machine. However, experienced sniffers can prevent this (e.g., using carefully designed firewall settings). An example is sending a ping (ICMP echo request) with the wrong MAC address but the right IP address. If an adapter is operating in normal mode, it will drop this frame, and the IP stack never sees or responds to it. If the adapter is in promiscuous mode, the frame will be passed on, and the IP stack on the machine (to which a MAC address has no meaning) will respond as it would to any other ping. The sniffer can prevent this by configuring a firewall to block ICMP traffic.

Some applications that use promiscuous mode

The following applications and applications classes use promiscuous mode. ;Packet Analyzer * NetScout Sniffer * Wireshark (formerly ''Ethereal'') * tcpdump * OmniPeek *

Capsa Gafsa ( aeb, ڨفصة '; ar, قفصة qafṣah), originally called Capsa in Latin, is the capital of Gafsa Governorate of Tunisia. It lends its Latin name to the Mesolithic Capsian culture. With a population of 111,170, Gafsa is the ninth-la ...

* ntop * Firesheep ;Virtual machine * VMware's VMnet bridging * VirtualBox bridging mode ;Containers * Docker with optional Macvlan driver on Linux ; Cryptanalysis * Aircrack-ng * AirSnort *

Cain and Abel In the biblical Book of Genesis, Cain ''Qayīn'', in pausa ''Qāyīn''; gr, Κάϊν ''Káïn''; ar, قابيل/قايين, Qābīl / Qāyīn and Abel ''Heḇel'', in pausa ''Hāḇel''; gr, Ἅβελ ''Hábel''; ar, هابيل, Hābīl ...

;Network monitoring * KisMAC (used for WLAN) * Kismet * IPTraf *

Snort Snort may refer to: * Nose-blowing * Sniffle * Nasal administration, the inhaling of drugs through the nose * Snort (software), a package for intrusion detection * Snort, a map-coloring game * Insufflation, the act of blowing, breathing, hissing, ...

CommView CommView is an application for network monitoring, packet analysis, and decoding. There are two editions of CommView: the standard edition for Ethernet networks and the wireless edition for 802.11 networks named CommView for WiFi. The application ...

;Gaming * XLink Kai

References

External links

SearchSecurity.com definition of promiscuous mode
{{DEFAULTSORT:Promiscuous Mode Network analyzers

Detection

Some applications that use promiscuous mode

See also

References

External links