On Sat, Apr 20, 2002 at 10:54:31AM -0700, Sumeet Suri wrote:
> I just wanted to use my NIC only for sniffing on my network.
> But I do NOT want the NIc to send out ARP packets.
>
> Is there a way to prevent the NIC from sending out ARP packets,
> and at the same time have the sniffer running.
On some operating systems, it might be possible to configure the network
interface *not* to have an IP address (or any other network-layer
address), which should prevent it from sending out ARP packets - it
probably wouldn't send out any network-layer packets, and would have no
need to send ARP requests, and would have no ARP table and wouldn't have
anybody asking for the MAC address corresponding to its IP address, and
would have no reason to reply to any ARP requests.
This would, of course, truly mean it'd be used *only* for sniffing - not
for doing any IP traffic, for example.
I cannot guarantee that this will work on all OSes, nor can I guarantee
that this won't cause other problems. (If that's the *only* network
interface on the machine, make sure you disable network-layer-address to
name resolution in Ethereal, as that would probably require use of NIS
or DNS, which would require that the machine be able to send out IP
packets.)
I cannot guarantee that it will cause *no* ARP packets to be sent.
I don't know what OSes it works on, nor do I know what you'd want to do
to persistently configure the interface to have no network-layer
addresses.