2

When I'm connected to a switch, the switch knows which MAC address belongs to which port. So even when I'm in promiscuous mode, why do I receive unicast packets that are addressed to other MAC addresses?

What I should get would be broadcasts and multicasts and unicasts to my MAC, I don't understand what this promiscuous mode is all about?

6 Answers 6

3

Switches operate by creating a table that maps the MAC addresses of devices to ports. They look up the destination MAC address to determine which port they should forward traffic and they should only forward unicast frames to this port.

The switch learns these MAC addresses whenever it receives traffic. If it receives frames on "Port A", it will learn the source MAC address of the device sending that traffic is down that port.

These entries will age out over time if there is no traffic received from the host. If the switch does not have an entry for a destination MAC address, it will "flood" a copy of the frame out each port besides the one it received the frame on. All broadcast and multicast traffic is also treated in the same manner since the traffic can be destined to multiple hosts (unless the switch supports more advanced features like IGMP snooping).

So, if you are seeing lots of unicast traffic destined to a different host, one of the following is the most likely explanation:

  1. The device with the destination MAC is only receiving and not generating any traffic and has either aged out of the table or was never in it.
  2. The resources the switch has available to insert new entries into the table are exhausted, meaning it won't add any new entries until some age out. This results in all traffic for this destination to be flooded.
  3. The switch is malfunctioning and not operating as a switch. This could be a firmware or a hardware problem.
  4. The switch is not actually a switch, but is rather a hub. Hubs work by always flooding a copy of the frame out each port it wasn't received on.
  5. Some switches can be configured to "mirror" traffic from one port to another. You normally only find this feature in managed switches.
0

Promiscuous mode was more useful in the days of thin-net and Ethernet hubs. You are right that an Ethernet switch learns which MAC addresses are connected to which ports and segregates traffic accordingly.

Some switches allow one port to be used as a monitoring port, all traffic passing throughthe switch is also transmitted to that port.

0

The switch doesn't send packets on links it knows do not need them. Unless it is a smart switch that is permanently configured to know that a particular MAC address is assigned to a particular port, it will 'leak' some frames.

0

Promiscuous mode on a NIC means that it wants to see all network traffic, not just ones intended for it. In "normal" mode, your NIC would see broadcasts, multicasts, and unicasts for it, but nothing else.

I guess the card could tell the switch it's in promiscuous mode, and then the switch would forward all traffic to it. That's all I can think of.

In normal operations, you don't need promiscuous mode. It's just for network monitoring, diagnosing problems, and so on.

1
  • Sorry, the NIC will not tell the switch it is in promiscuous mode.
    – YLearn
    Dec 11, 2013 at 3:42
0

The switch might not know all the hosts and the default behavior for the switch to do in case it doesn't know which port to send is treat it as bc/mc and the switch will flood the packet out of all ports in that vlan. This is called unknown unicast flood.

0

A switch 'floods' all ports when it doesn't know where the destination MAC address is.

The port that responds is how the switch learns what port has what MAC. The type of memory that a switch stores this information is called 'Content Addressable Memory', or CAM tables.

So, when traffic comes in to the switch, and the switch has recognized that destination MAC, the switch will only forward to that specific known port.

If different traffic comes in where it does NOT recognize the destination MAC, it floods all ports, including ones that it has previously 'discovered' a MAC is at.

So basically a switch can 'assign' more than one MAC to a port in its CAM tables.

That would explain why your NIC is getting frames from any MAC even though it's behind a switch. I have never thought about this before and may be wrong but that's really the only way it could work. On enterprise level switches you probably can modify or disable this behavior.

Promiscuous mode is useful if you want to set up virtual bridges on the system the NIC lives on. Virtual bridges let you tie one or more NICs on a system into a bridge - essentially, making a virtual 'switch' or Layer 2 forwarding. Promiscuous mode is also useful if you want to capture traffic on a network, obviously.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .