How do I turn on promiscuous mode in Wireshark?

Why it is important to open Wireshark with the promiscuous mode turned off?

This is a common question that I got many times when I talk about packet sniffing and wireless protocols, so I prepared this small tutorial.

My motivation for writing this article is to help people trying to sniff a wireless network using Wireshark (Wireshark version: 1.4.1). The other one that caught my attention was this question on stack overflow: Wireshark/Ethereal on Linux- What is the purpose of running them in promiscuous mode. This question caught my attention because after many years of packet sniffing it always surprises me to discover that a common mistake I see in tutorials are people using only promiscuous mode to listen to a wireless network. Promiscuous mode is great and we don't need any problem if we're using it correctly. In this article I'd like to help people understand what promiscuous mode really does and what are the reasons that we need it. By the end of this article you'll get to know everything you need to understand promiscuous mode from a beginner point of view.

First of all you need to understand that promiscuous mode only allows sniffing of packets (or listening to a network) from the outside (from an end-user to a router or a Access Point). I'm not talking about the internal mode that Wireshark can do by simply configuring promiscuous as a filter in options and setting your interface in promiscuous mode. I'm talking about the external promiscuous mode that you need to turn off after you start Wireshark and then you're able to listen to any type of network using the external interface.

What promiscuous mode does exactly. Now we've got everything we need to understand what promiscuous mode actually does, take a look on figure 1.2: When you start Wireshark in promiscuous mode it is listening to the ethernet frames. Once you start sniffing a network with the external interface enabled and then it listens to anything that comes from your end-user network adapters (Router, wireless NIC, etc). As you can see in figure 1.2 we've got two end-user ethernet cards here, one that's talking to the router (LAN card) and another one that is talking to the wireless access point.

How do I disable promiscuous mode in Ethernet?

Hi guys, I was wondering how do I disable promiscuous mode on my Ethernet card?

I have a USB device plugged in my PC, but I'm not allowed to read the incoming data because of promiscuous mode. Is there any way to disable this? I had this problem too in Windows XP (I've recently switched from Win2000). You may try using Device Manager to unload the driver for the network adapter.

CplusmacDec 11 '12 at 1:09. 3 Answers.
To set a device into promiscuous mode without loading an Ethernet driver, you can use a configuration file in /etc/sysconfig/network-scripts called eth0. If the file is empty, it will be used as if eth0 didn't exist, so I'd check the file manually before writing to it. I guess this is what happens if you don't mention the interface when defining the interface eth0 (and maybe if you don't load any drivers for the device).

So if you have an eth0 configuration (eg ifconfig), change the options to promiscuous for both iface and use. As you suggested, I checked my network settings with "ifconfig" command. I couldn't find the information "Promiscuous". Instead, I have the option "Promiscuous", I didn't notice this option in the above answers. Thanks you.

CplusmacDec 17 '12 at 15:10. If you don't need the port for another application, you should not disable that option. This will let other users and applications communicate with you, or use it themselves.

Fyodor DedeninovDec 18 '12 at 0:15. Thanks a lot. I've tried to find this option by myself, since this option was enabled during installation, I thought it's possible to disable this option. But, it looks like I was wrong. I'm sorry for misleading answers.

CplusmacDec 17 '12 at 15:30. When you are setting up a virtual network interface for use with virtual servers, you are going to want to disable promiscuous mode, since promiscuous mode is one of the reasons for not being able to use a virtual server with a USB device.

How do I turn on promiscuous mode in Wireshark?

The "promiscuous" mode in Wireshark makes the capture data available from all network interfaces.

The reason to turn this mode on is that Wireshark uses it for packet analysis, but capturing with "promiscuous mode" on gives only one interface name, for example "enp0s25".

When you want to see if some traffic is coming out of your system, you have to monitor the interface for activity. Wireshark allows you to choose which interface to capture on. Wireshark displays the active interface in the "Interface list".

How do I turn off promiscuous mode?

When a PC is booted, Windows typically loads the TCP/IP protocol stack.

This protocol stack is responsible for handling network traffic. At bootup, Windows enables by default promiscuous mode in order to listen on every available network port for network traffic.

By default, promiscuous mode means that Windows will listen on any open network port and will buffer traffic. Promiscuous mode does not provide security. If an attacker manages to get access to a PC running Windows, an attacker can send arbitrary network traffic on a port where Windows is listening. This includes sending a large number of requests to your web server or scanning for open ports on your server.

Once promiscuous mode is enabled at bootup, it stays enabled until you turn off the ability to listen on any network port. Turning off promiscuous mode. After Windows boots up and reaches a stable operating state, the TCP/IP protocol stack is started. At this time, Windows starts to listen on any available network port. This means that Windows enables promiscuous mode, which turns on the ability to listen on any available network port.

To turn off promiscuous mode, perform the following steps: Open the Network and Sharing Center. Select Change advanced sharing settings. In the Network and Sharing Center, select Properties. In the Network and Sharing Center, on the Advanced tab, click Change advanced sharing settings. Click Change settings in the Advanced Sharing Settings dialog box. In the properties dialog box, clear the check box that says "Promiscuous mode (NetBIOS only) or "Promiscuous mode (TCP/IP)" to allow promiscuous mode on any network port. Click OK.

When you enable promiscuous mode, Windows will listen on any available network port. This means that you can have an attacker send network traffic to your server.

The Promiscuous Mode (TCP/IP) option will be enabled automatically when you select the "Promiscuous mode (TCP/IP)" option on the Network and Sharing Center. Promiscuous mode (NetBIOS only) should be disabled when you are using SMB protocol in Windows. To disable the ability to listen on any network port in Windows: On the Network and Sharing Center's Options menu, select Change advanced sharing settings.