Network Analyzer (E...
 
Notifications
Clear all

Network Analyzer (Ethereal / Wireshark) & Promiscuous Mode

2 Posts
2 Users
0 Reactions
549 Views
(@mwade)
Trusted Member
Joined: 18 years ago
Posts: 77
Topic starter  

Hello,

From my understanding when you run an interface in promiscuous mode you are not allowing the interface to send any traffic, hence hiding in from the network. In the Wireshark application, if you have the Promisuous mode box checked and the Enable network name resolution is checked how does the interface resolve a name if its suppose to be in RROM?

From Wireshark's docs it says that it introduces traffic to the net.
Wireshark will not manipulate things on the network, it will only "measure" things from it. Wireshark doesn't send packets on the network or do other active things (except for name resolutions, but even that can be disabled).

I am guessing that I have a miss understanding of PROM mode.

Thanks,

mark


   
Quote
(@kovar)
Prominent Member
Joined: 18 years ago
Posts: 805
 

Greetings,

Promiscuous mode doesn't prevent the interface from sending any traffic.

Even if Wireshark isn't sending anything out, other applications and services on the system might be generating network traffic.

If you want a "dark" system, I think you'll need to spend a bit of time carefully configuring your system starting with a firewall on the system.

-David


   
ReplyQuote
Share: