Windows 10 Force NIC into Promiscuous Mode

Question

This may be a dumb question and may not be possible. I want to turn promiscuous mode on/off manually to view packets being sent to my PC. I have port mirroring setup on a managed switch and I can't see the packets that are being forwarded to the PC. Is it possible, through a PowerShell command or something, to turn promiscuous mode on/off for a network adapter? I'm using Windows 10 Pro if that makes any difference.

Solution

So, if you are trying to do MS Message Analyzer or Wireshark type stuff, why not just install and use them, since they will set your nic that way.

You could do the poor man's MSMA/WS by using PS and Netsh as well as use / tweak the below resources for your use case.

Start and Stop a Packet Capture from PowerShell Have you ever had a need to do a quick packet capture on something but didn’t want to mess with installing Wireshark or Netmon? You’re in luck! Today, I decided to PowerShellify the method to kick off a packet capture via netsh. In this file there are two functions; Start-Packe https://gallery.technet.microsoft.com/scriptcenter/Start-and-Stop-a-Packet-cce358e8 https://github.com/adbertram/Random-PowerShell-Work/blob/master/Networking/PacketCapture.ps1

PSNetMon - PowerShell Network Resource Monitoring Utility Network resource monitoring utility written in HTML and PowerShell. Completely customizable. Monitor hosts, ports and services. Always a work in progress. Looking for others to help with development. https://gallery.technet.microsoft.com/PSNetMon-PowerShell-cd2b345e

Networksniffertools_module_functions_for_realtime https://github.com/pldmgg/misc-powershell/tree/master/MyModules/Network-SnifferTools

If you really just want to enable PM on the nic, netsh can do this directly, with or without PS involved...

Get your Nic info.

netsh bridge show adapter

A bridge allows you to connect two or more network segments together allowing devices to join the network when it's not possible to connect them directly to a router or switch.

enable the Promiscuous Mode

netsh bridge set adapter 1 forcecompatmode=enable

# View which nics are in PromiscuousMode
Get-NetAdapter | Format-List -Property ifAlias,PromiscuousMode

See also:

Basic Network Capture Methods https://blogs.technet.microsoft.com/askpfeplat/2016/12/27/basic-network-capture-methods

If this is Hyper-V then, this...

https://blogs.technet.microsoft.com/networking/2015/10/16/setting-up-port-mirroring-to-capture-mirrored-traffic-on-a-hyper-v-virtual-machine

Comments

[AdamH]

I'm not really trying to capture packets is why I don't want to use Wireshark or another packet capturing software. I have a piece of software that is interpreting packets in real-time from another device. I just need my NIC in PM so the software can "see" the packets when I use port mirroring. The second method requires that I bridge connections, correct? Does it create other problems if I bridge two connections? I'm not really sure what bridging connections in Windows does.

[postanote]

OK, bridge, yes, problems no. A bridge allows you to connect two or more network segments together allowing devices to join the network when it's not possible to connect them directly to a router or switch.