Wrongdefinition of promiscuous mode?

szmarcek

Promiscuous mode is a state in which a network adapter card copies all the frames that pass over the network to a local buffer, regardless of the destination address. This mode enables Network Monitor to capture and display all network traffic.


This is a definition used provided my Microsoft on one of their FAQ. Correct me if I am wrong but this seems to be a bit of overstatement especially the part ‘regardless of the destination address’. No matter what the network analyzer is used, you will only be able to see broadcast traffic (not sure about multicast) and the unicast directed to the machine that you are using. You should not be able to see all frames that passes over the network because modern switches will not let you (unless you are using something like SPAN or RSPAN, and forwarding the traffic onto a specific port).

Is my thinking wrong?

redwarrior

I may be wrong here, but I think using span or rspan or else a hub is pretty much assumed here. Basically, they're only concerned with explaining what's going on with the NIC and not what you would have to do to the network to use the NIC in this manner.

kryolla

What redwarrior said when using span or rspan it redirects whatever traffic the port is spanning to your PC. By default your PC will drop all packets not intended for it except broacast and multicast. So if it drops the rest of the packets how can you capture and analyze the traffic from the spanned port. This is where promiscuous comes in and it captures all traffic from that spanned port or vlan regardless of the destination. So the definition is right

szmarcek

Assumptions, assumptions ...

Ok, thanks for a reply. So the definition is correct , though it could be better (more detailed).


Thanks for explanation.

kryolla

its from microsoft what do you expect lol