What does ifconfig promisc mode do, or promiscuous mode in general?

Question

This is what man ifconfig has to say about it.

[-]promisc

   Enable or disable the promiscuous mode of the interface.  If

selected, all packets on the network will be received by the interface.

Looking for specifically if this means in regards to a wireless card:

• accept all despite the IP destination (as I read it, clued by packets);
• accept all frames despite the MAC address;
• or, accept all frames and packets periods.

Solution

Generally speaking, "promiscuous mode" means that a network interface card will pass all frames received up to the operating system for processing, versus the traditional mode of operation wherein only frames destined for the NIC's MAC address or a broadcast address will be passed up to the OS. Generally, promiscuous mode is used to "sniff" all traffic on the wire.

Wireless Ethernet NICs are a bit of a different animal than wired NICs, though. Unlike a wired medium, the wireless medium has additional concerns (association with a given access point, selection of a given channel). For "sniffing" of wireless Ethernet traffic you generally need a wireless NIC and an OS driver that support an "RF monitoring mode" versus promiscuous mode.

Some decent references:

• http://en.wikipedia.org/wiki/Promiscuous_mode

• http://en.wikipedia.org/wiki/Monitor_mode

Comments

[Evan Carroll]

right, so promisc is a level two pass-through to OS.

[Spence]

Mostly. With 802.11 NICs, though, it's more like "layer 2 and a half"...