ARP - promiscuous mode
The Address Resolution Protocol or ARP is a protocol used with IPv4 networks to determine the MAC address that corresponds to a particular IP address.
ARP can populate theARP table in one of two modes: normal, and promiscuous.
In normal mode, which is typically the default operating mode, a host only processes packets addressed to its own MAC address, as well as broadcast packets and multicast packets for which the host's NIC is specifically configured to listen. In this mode, if a NIC receives an ARP request that is broadcast on the network segment, it will open it and take a look at the target IP address (the IP address for which the request wants to learn the corresponding MAC address). If that address is not its own, it will not process the request any further, and it will discard it. Even though the sender MAC and IP are available to it, it will not populate its ARP.
In promiscuous mode, the NIC processes all packets it sees on the network, regardless of the destination MAC address. It effectively “listens” to all the traffic in its network segment. If it receives an ARP request, it will look at the sender’s IP and MAC addresses and use that information to populate its ARP table.
Now what mode is the default, and what mode you are able to configure depends upon the host in question. On a Windows device, promiscuous mode is typically controlled by software applications that may require it. For example, Wireshark can be configured to use promiscuous mode to listen to and process packets arriving on a NIC.
Links:
https://forum.networklessons.com/t/arp-address-resolution-protocol-explained/864/164?u=lagapides