Promiscuous mode

In computer networking, promiscuous mode or promisc mode is a mode for a network interface controller (NIC) that causes the NIC to pass all traffic it receives to the central processing unit (CPU) rather than just passing frames the NIC is intended to receive. This mode is normally used for packet sniffing and bridged networking for hardware virtualization.

In IEEE 802 networks such as Ethernet, token ring, and Wi-Fi, and in FDDI, each frame includes a destination Media Access Control address (MAC address). In non-promiscuous mode, when a NIC receives a frame, it normally drops it unless the frame is addressed to that NIC's MAC address or is a broadcast or multicast frame. In promiscuous mode, however, the card allows all frames through, thus allowing the computer to read frames intended for other machines or network devices.

Many operating systems require superuser privileges to enable promiscuous mode. A non-routing node in promiscuous mode can generally only monitor traffic to and from other nodes within the same broadcast domain (for Ethernet and Wi-Fi) or ring (for token ring or FDDI). Computers attached to the same network hub satisfy this requirement, which is why network switches are used to combat malicious use of promiscuous mode. A router may monitor all traffic that it routes.

Promiscuous mode is often used to diagnose network connectivity issues. There are programs that make use of this feature to show the user all the data being transferred over the network. Some protocols like FTP and Telnet transfer data and passwords in clear text, without encryption, and network scanners can see this data. Therefore, computer users are encouraged to stay away from insecure protocols like telnet and use more secure ones such as SSH.

Detection

As promiscuous mode can be used in a malicious way to sniff on a network, one might be interested in detecting network devices that are in promiscuous mode. In promiscuous mode, some software might send responses to frames even though they were addressed to another machine. However, experienced sniffers can prevent this (e.g., using carefully designed firewall settings). An example is sending a ping (ICMP echo request) with the wrong MAC address but the right IP address. If your firewall blocks all ICMP traffic, this will be prevented.

Some applications that use promiscuous mode

• NetScout Sniffer
• OmniPeek
• Capsa for WiFi
• Aircrack-ng
• KisMAC (used for WLAN)
• AirSnort (used for WLAN)
• Wireshark (formerly Ethereal)
• tcpdump
• IPTraf
• PRTG
• Kismet
• VMware's VMnet Bridging (networking)
• Cain and Abel
• Driftnet Software
• Microsoft Windows Network Bridge
• XLink Kai
• WC3Banlist
• Snort
• ntop
• Firesheep
• VirtualBox (bridge networking mode)
• CommView for WiFi
• AccessData SilentRunner

External links

SearchSecurity.com definition of promiscuous mode

See also

• Packet analyzer
• Monitor mode