-1

I am running Ubuntu Linux and had installed Wireshark on it. I can see the incoming and outgoing traffic just fine. but as you know when you run Wireshark your nic should be on promiscuous mode.

when I check my nic status with netstat -i I can't see p flag that shown promiscuous mode, so that means my nic is not in promiscuous mode?

how can I know my nic is on promiscuous mode when I run Wireshark?

AlirezaK
  • 316
  • 3
  • 20
poyan_msd
  • 1
  • 3
  • 5
    You say: "when you run Wireshark your nic should be on promiscuous mode." But that's not true. In most cases you should leave it as is. Only in rare cases do you actually need to turn on promiscuous mode. – kasperd Feb 17 '19 at 14:06

2 Answers2

1

Promiscuous mode is only needed if you need to capture not related to your device (for example arp discovery)

https://www.wireshark.org/docs/wsug_html_chunked/ChCapEditInterfaceSettingsSection.html

pbacterio
  • 276
  • 2
  • 6
0

Promiscuous mode is only relevant if you want to capture traffic bound for other network interfaces. In such a case it’s usually not enough to enable promiscuous mode on your own NIC, but you must ensure that you’re connected to a common switch with the devices on which you want to eavesdrop, and the switch must also allow promiscuous mode or port mirroring. But again: The most common use cases for Wireshark - that is: when you run the program on one of the nodes you’re troubleshooting - do not require promiscuous mode.

That said, on recent Ubuntu versions it doesn’t seem as though promiscuous mode is supported via Netplan (https://askubuntu.com/questions/1056433/any-way-to-set-interface-to-promiscuous-in-18-04-using-netplan), so you would need to install and configure ifupdown. With that done, you should be able to configure promiscuous mode by following this old AskUbuntu post: https://askubuntu.com/questions/430355/configure-a-network-interface-into-promiscuous-mode

Mikael H
  • 4,868
  • 2
  • 8
  • 15
  • txn for your answer, but my queston is that :why when i run wireshark my nic is not in promiscuous mode ? – poyan_msd Feb 18 '19 at 14:38
  • Do you tell Wireshark to put your nic in promiscuous mode? Does it know how to, and if so, is it allowed to? – Mikael H Feb 18 '19 at 14:56