0

I'm not sure I fully understand promiscuous mode.

I will try to outline my train of thought, and hopefully someone will be able to tell me where I'm wrong:

The definition of promiscuous mode seems to be that the network adapter will not drop packets that are not addressed to it. As we're looking at a layer 2 technology, the addressing is done via MAC addresses. Switches learn MAC addresses, and will thus, be able to determine out of which port they will forward packets. Additionally, we have broadcast packets that are addressed to everyone by virtue of having FF:FF:FF:FF:FF as their destination address.

Let's say I enable promiscuous mode on my network network adapter, which packets will I receive which would otherwise be dropped? I will still need to be able to listen to broadcasts and packets not having my MAC address as destination won't be forwarded to my PC, because the Switch will forward them out of a different port.

I suspect this is really simple and I'm overlooking something.

3

What you've said holds true... however...

Let's say I enable promiscuous mode on my network network adapter, which packets will I receive which would otherwise be dropped?

If you're trying to pickup traffic from other hosts while using a switch (rather than a hub), then you'll want to look into "Port Mirroring" - not a feature usually found on basic switches.

As you mentioned, switches will "learn" where hosts are, and will forward traffic only to ports that are associated with a given host. You might see the occasional packet that is not destined for you - this is because when a switch doesn't know where to send the traffic, it will send it to all ports.

Some super cheap / basic switches are really bad at this, with a tiny lookup table or quick expiry, but you may occasionally see this with better switches too (i.e: the first packet ever, or first packet for a long time).

Many people still use a hub to achieve what they're after, especially in classroom scenarios, but this excludes Gigabit connections... the other option is to get a more expensive "managed switch" that will allow you to configure port mirroring - however, be aware that you will only see traffic for hosts on that switch...


Let's say I enable promiscuous mode on my network network adapter, which packets will I receive which would otherwise be dropped?

Reading this a different way - in "promiscuous mode" your network card won't drop any packets... but your network stack will drop any that it's not interested in at the level above.

If you were to capture the traffic (i.e: use Wireshark, or tcpdump), then the kernel will be able to provide you with all traffic that is present at the network interface - depending on your filters, you could capture everything.

It's also worth mentioning that not all network interfaces are able to truly support promiscuous mode - for example many WiFi adapters can't.


My question is a technical question about promiscuous mode. I don't see how it's particularly useful out of VM applications.

Capturing network traffic is extremely useful, for a wide variety of reasons:

  • Debugging protocols / applications / service configuration and reverse engineering
    • "why am I not getting the expected response?"
    • "why is DNS not working as I expected?"
    • "how does this application communicate with services?"
  • Investigating performance issues
    • "why is there so much traffic?"
    • "why is the network so slow?"
  • Monitoring the network for security issues - new hosts, etc...

In many cases, you cannot capture this information from a host directly - think embedded systems, or whole network monitoring.

  • Thank you. Just to be clear, I'm fully aware that I could do "other things" like using hubs or port mirroring. My question is a technical question about promiscuous mode. I don't see how it's particularly useful out of VM applications. – Fang Mar 16 '19 at 20:13
  • Oh sorry... I've added an answer to another interpretation of your question... if that's still not useful, then please could you expand on what you're asking? – Attie Mar 16 '19 at 20:18
  • I'm not sure what the actual use of promiscuous mode is if - outside of a handful of erroneous frames - frames that are not addressed to my NIC won't reach my NIC anyway, in which case promiscuous mode is useless. I see the application for VMs that share a NIC on the same host, but that's it. – Fang Mar 16 '19 at 20:23
  • Did you see my latest edit about debugging / reverse engineering / monitoring? Does that help? – Attie Mar 16 '19 at 20:25
  • Well - no. Simply because I can't monitor or debug any frame that will never make it to my NIC in the first place. That's exactly what I don't understand! I'm a bit loathe to continue the conversation in comments, as SU is not suited to that kind of conversation, so apologies if I won't reply further. Clearly, the way I worded my question wasn't concise enough. – Fang Mar 16 '19 at 20:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.