Network Operation Modes — Kurnianto Trilaksono

Network Interface Cards (NICs) operate in two distinct modes that affect how they handle network traffic. This distinction applies to all networked devices, including routers, switches, and personal computers.

Promiscuous Mode

In this mode, the NIC indiscriminately captures all network traffic passing through it at Layer 2 (Data Link Layer), including:

Packets directed to your network interface
Broadcast packets
Multicast packets
Packets intended for other Layer 2 interfaces

This mode reveals MAC addresses, IP addresses + port, and arrival time of source and destination across all network packets, regardless of their actual destination — enabling network mapping and identification of connected networks.

Non-Promiscuous Mode

The standard operating mode restricts capture to traffic specifically directed to that NIC, including only packets destined to your network interface, broadcast packets, and multicast packets.

Key Considerations

Promiscuous mode introduces noise into captured traffic data due to its comprehensive nature. The choice between modes depends on your monitoring objectives. One limitation: packets can be dropped by the network interface before the capture library gets to process them.

This is about traffic visibility, not a security control on its own.