Capture All Traffic in Promiscuous Mode

What Promiscuous Mode Does

Normally a NIC delivers only frames addressed to its MAC, broadcast (ff:ff:ff:ff:ff:ff), or subscribed multicast groups. Promiscuous mode removes that filter so every frame on the wire reaches user space. For example, you might see ARP exchanges between 192.168.1.1 and other hosts even though neither endpoint is your machine.

Enabling It on Linux

Two common paths:

• AF_PACKET socket + setsockopt(PACKET_ADD_MEMBERSHIP, PACKET_MR_PROMISC)
• libpcap's pcap_open_live() with promiscuous flag enabled

Both require root or CAP_NET_RAW. On a switched network you still mostly see broadcast and flooded traffic unless you use port mirroring or ARP spoofing.

Promiscuous vs Monitor Mode

• Promiscuous: wired Ethernet, standard frames with EtherType 0x0800
• Monitor: wireless only, raw 802.11 management and control frames

In normal mode your NIC might deliver only a few hundred frames per second addressed to its MAC. In promiscuous mode on a busy hub or mirrored switch port, you could see thousands of frames per second including ARP broadcasts, DHCP offers, and unicast traffic between other hosts on 192.168.1.0/24.

Why This Exercise

This task asks you to document promiscuous mode setup and simulate receiving packets. libpcap uses this exact PACKET_MR_PROMISC path under Wireshark and tcpdump, and understanding it explains why switched networks limit what you can sniff without extra techniques. The 2010 Firesheep tool demonstrated how much session data was exposed on shared Wi-Fi networks when anyone could capture HTTP cookies in promiscuous mode.