Promiscuous mode allows network adapters to receive and process all packets, regardless of type or recipient. It is used by network analyzers and packet sniffers to capture and analyze network traffic. Multicast mode can also be enabled on some adapters, but it places strain on the driver and protocol stack.
Promiscuous mode is a network adapter configuration that passes all packets to the network adapter driver and protocol stack. It is supported by many wired and wireless network adapters and their drivers. Promiscuous mode is used by network analyzers, protocol analyzers, and packet sniffers to enable inspection of network traffic. It is also used by some network bridges to transfer traffic from one side of the bridge to the other.
A network card “listens” the header of each packet traveling on the connected network. In its normal operating mode, it only processes unicast and broadcast packets. A unicast packet is one that is specifically addressed to only one network card. Conversely, a broadcast packet must be received by all devices connected to the network. Both types of packets are normally received by an adapter, processed by its driver, and passed up the network protocol stack.
An application or operating system (OS) can also enable multicast mode on a network adapter that supports it. To use this mode, one or more multicast group addresses are programmed into the card via its driver. When multicast mode is enabled, the adapter also receives and processes all multicast packets addressed to the group. By comparison, promiscuous mode allows all packets to be received and processed, regardless of type or recipient.
Network adapters that do not include hardware multicast address support place significant strain on the drivers and protocol stack. When multicast mode is enabled on a card like this, the hardware is usually placed in promiscuous mode. The software must then filter out any packets that are not directed to one of the desired multicast group addresses. This places a very significant load on the central processor and operating system kernel. Typically, the response time of the network also increases.
Packet sniffing is often the primary use for promiscuous mode, also known as promiscuous mode. Network analyzers and packet sniffer software in this mode can capture all network traffic, which they can “hear”. Once received, packets can be archived for later analysis and decoding with the same or more complex software. Traffic received in this mode on a wired network is usually limited to machines connected to a network switch or hub. Wireless traffic is normally limited to a particular set of services or channel, unless radio frequency monitoring mode is used.
Protect your devices with Threat Protection by NordVPN
