Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This is what man ifconfig has to say about it.

[-]promisc

   Enable or disable the promiscuous mode of the interface.  If

selected, all packets on the network will be received by the interface.

Looking for specifically if this means in regards to a wireless card:

  • accept all despite the IP destination (as I read it, clued by packets);
  • accept all frames despite the MAC address;
  • or, accept all frames and packets periods.
share|improve this question
add comment

3 Answers

up vote 9 down vote accepted

Generally speaking, "promiscuous mode" means that a network interface card will pass all frames received up to the operating system for processing, versus the traditional mode of operation wherein only frames destined for the NIC's MAC address or a broadcast address will be passed up to the OS. Generally, promiscuous mode is used to "sniff" all traffic on the wire.

Wireless Ethernet NICs are a bit of a different animal than wired NICs, though. Unlike a wired medium, the wireless medium has additional concerns (association with a given access point, selection of a given channel). For "sniffing" of wireless Ethernet traffic you generally need a wireless NIC and an OS driver that support an "RF monitoring mode" versus promiscuous mode.

Some decent references:

share|improve this answer
    
right, so promisc is a level two pass-through to OS. –  Evan Carroll Jan 27 '10 at 2:48
    
Mostly. With 802.11 NICs, though, it's more like "layer 2 and a half"... –  Evan Anderson Jan 27 '10 at 2:49
add comment
  • There are two stages to connecting with a wireless network, and
  • Not all wireless cards will support a proper promisc-mode

This article might be a useful starter too: Stumbling and Sniffing Wireless Networks in Linux

share|improve this answer
add comment

When a network card work under promiscuous mode, it means it will receive all packets bypass it,no matter it is sent to this computer or others.That's how the packet sniffing works.

share|improve this answer
    
this unfortunately was all said in the question, "sniffing" seems to mean both receiving and analyzing packets destined to other ip address, and frames destined for other mac address. Certainly, one mode wouldn't turn on both of them... It seems to me, as if promisc now is data-link pass through. –  Evan Carroll Jan 27 '10 at 7:07
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.