Ethereal-users: Re: [Ethereal-users] Promiscuous mode

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Guy Harris" <gharris@xxxxxxxxx>
Date: Tue, 24 Dec 2002 12:41:47 -0800 (PST)
Anthony Scott said:
> I am trying to set my NICs in promiscuous mode. I have one Intel Pro 100
> and one Intel Pro 1000 on Windows 2K Pro and Server. I can not find any
> documentation on Intel's site about doing this.  Can anyone help me?

By "set my NICs into promiscuous mode" do you mean "do a promiscuous-mode
capture in Ethereal" or do you mean "put the NICs permanently into
promiscuous mode regardless of whether Ethereal, or any other packet
sniffer, is running"?

In the former case, if the driver and NIC support promiscuous mode and the
standard Windows NDIS internal interfaces for requesting promiscuous mode,
WinPcap should put the NICs into promiscuous mode if the program using
WinPcap to open the interface asks to open it in promiscuous mode. 
Ethereal uses WinPcap to do packet capture and, if you've told it to do a
promiscuous-mode capture, tries to open the interface in promiscuous mode,
so it should Just Work as long as you haven't changed the "Capture
Options" dialog box item *not* to request promiscuous mode when capturing.

If your real question is "Ethereal isn't doing promiscuous mode captures;
what do I need to do to get it to do so?", then you should first look at

http://www.ethereal.com/faq.html#q5.1

to make sure the *real* problem isn't that it *is* capturing in
promiscuous mode but promiscuous mode isn't giving you all the packets you
want.

If promiscuous mode isn't working and it's *not* a switched-network or
dual-speed-hub problem, then try capturing in promiscuous mode with
WinDump:

http://windump.polito.it

If *that* doesn't work, report this as a bug to the WinPcap developers:

http://winpcap.polito.it/contact.htm

being sure to give them *all* the details they ask for.

If you want to *permanently* put the NIC into promiscuous mode, for
whatever reason that might be, I can't help you - I don't know of any
program that does so.