Solved

Promiscuous mode

Posted on 2004-09-13
9
328 Views
Last Modified: 2006-11-17
Is there any solution for sniffing WITHOUT setting the promiscuous mode ?
0
Comment
Question by:DanLazar
9 Comments
 
LVL 22

Accepted Solution

by:
cookre earned 125 total points
ID: 12046070
No.  
Unless the NIC supports and is placeed in promiscuous mode, it will not report packets not intended for it.
0
 
LVL 5

Assisted Solution

by:danielsonchris
danielsonchris earned 125 total points
ID: 12046107
Promiscuous mode just means to not clear the buffer on the network card. The nature of a un-switched network is to relay packets throughout and the computer with the corresponding MAC address will accept the packet and digest it.  Turning on promiscuous mode basically tells the network card to not disregard the packet even though the MAC address does not match.  Unless you have a software application running to digest the packet it will soon be cleared out of the buffer (in the case of promiscuous mode).  Basically promiscuous mode means to put the packet into a volatile buffer such that an application such as Ethereal could digest it and display it's contents.

So the answer is no, you must have promiscuous mode turned on.  Otherwise the packet is never copied into the buffer.  Some cards have hacks that allow you to enable this if it's not enabled by default.
Regards,
Chris
0
 
LVL 41

Assisted Solution

by:graye
graye earned 125 total points
ID: 12050616
...and to make things more complicated.   The promiscuous mode has to be set both on the NIC and at the hub/switch.   Almost all hubs are now actually switches... so they too must be configured to pass all traffic to a particular port.   A low-cost hub might not even be configurable to become promiscuous.
0
Courses: Start Training Online With Pros, Today

Brush up on the basics or master the advanced techniques required to earn essential industry certifications, with Courses. Enroll in a course and start learning today. Training topics range from Android App Dev to the Xen Virtualization Platform.

 
LVL 6

Assisted Solution

by:DominicCronin
DominicCronin earned 125 total points
ID: 12093138
It all depends what you mean by a "solution for sniffing". If all you want to do is debug some network traffic, it's very common to put some sort of proxy in between the client and the server.
0
 
LVL 22

Expert Comment

by:cookre
ID: 12320589
All of us agreed that the answer is 'no'.
0
 
LVL 6

Expert Comment

by:DominicCronin
ID: 12326949
Actually cookre, although I *do* agree that if you want to "sniff" then promiscuous mode is necessary, my suggestion was that often the problems you can solve by "sniffing" can be solved by interposing a proxy. The trouble is that word "sniff", isn't it? There's no "official" definition. Maybe we should get together and submit an RFC defining the word :-)

If sniff means "listen to network traffic not intended for your network interface", and "promiscuous mode" means "don't ignore traffic not intended for this network interface", then it's pretty obvious that you can't sniff without promiscuous mode. That still doesn't get us to a "solution" for sniffing.

What I sometimes think would be helpful would be having the option to change the question title to make it more useful to future PAQ hunters. After all, there's some useful knowledge in this thread, so it would be good to have it as a PAQ, but my worry is that the title won't help anyone to find the answers they need here.

As always - the hard part is getting the questioner to state their problem for what it is, rather than jumping in half-way towards their own perception of where the solution lies. It's unlikely that the questioner really wants to "sniff". DanLazar - if you are there - what did you really want to do?
0

Featured Post

Courses: Start Training Online With Pros, Today

Brush up on the basics or master the advanced techniques required to earn essential industry certifications, with Courses. Enroll in a course and start learning today. Training topics range from Android App Dev to the Xen Virtualization Platform.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Here we come across an interesting topic of coding guidelines while designing automation test scripts. The scope of this article will not be limited to QTP but to an overall extent of using VB Scripting for automation projects. Introduction Now…
This article is meant to give a basic understanding of how to use R Sweave as a way to merge LaTeX and R code seamlessly into one presentable document.
With the power of JIRA, there's an unlimited number of ways you can customize it, use it and benefit from it. With that in mind, there's bound to be things that I wasn't able to cover in this course. With this summary we'll look at some places to go…
In this seventh video of the Xpdf series, we discuss and demonstrate the PDFfonts utility, which lists all the fonts used in a PDF file. It does this via a command line interface, making it suitable for use in programs, scripts, batch files — any pl…

776 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question