-1

I am running Ubuntu Linux and had installed Wireshark on it. I can see the incoming and outgoing traffic just fine. but as you know when you run Wireshark your nic should be on promiscuous mode.

when I check my nic status with netstat -i I can't see p flag that shown promiscuous mode, so that means my nic is not in promiscuous mode?

how can I know my nic is on promiscuous mode when I run Wireshark?

Arani
  • 358
  • 2
  • 4
  • 21
poyan_msd
  • 1

2 Answers2

1

Promiscuous mode is only needed if you need to capture not related to your device (for example arp discovery)

https://www.wireshark.org/docs/wsug_html_chunked/ChCapEditInterfaceSettingsSection.html

pbacterio
  • 286
0

Promiscuous mode is only relevant if you want to capture traffic bound for other network interfaces. In such a case it’s usually not enough to enable promiscuous mode on your own NIC, but you must ensure that you’re connected to a common switch with the devices on which you want to eavesdrop, and the switch must also allow promiscuous mode or port mirroring. But again: The most common use cases for Wireshark - that is: when you run the program on one of the nodes you’re troubleshooting - do not require promiscuous mode.

That said, on recent Ubuntu versions it doesn’t seem as though promiscuous mode is supported via Netplan (https://askubuntu.com/questions/1056433/any-way-to-set-interface-to-promiscuous-in-18-04-using-netplan), so you would need to install and configure ifupdown. With that done, you should be able to configure promiscuous mode by following this old AskUbuntu post: https://askubuntu.com/questions/430355/configure-a-network-interface-into-promiscuous-mode

Mikael H
  • 5,179