NIC Promiscuous Mode

Promiscuous mode is a configuration setting for a Network Interface Card (NIC) that allows it to pass all incoming traffic to the CPU, rather than just the packets addressed to it.

Normal Mode

In normal mode, which is typically the default operating mode, a host only processes packets addressed to its own MAC address, as well as broadcast packets and multicast packets for which the host's NIC is specifically configured to listen.

Promiscuous Mode

In promiscuous mode, the NIC processes all packets it sees on the network, regardless of the destination MAC address. It effectively “listens” to all the traffic in its network segment. If it receives an ARP request, it will look at the sender’s IP and MAC addresses and use that information to populate its ARP table.

Now what mode is the default, and what mode you are able to configure depends upon the host. On a Windows device, promiscuous mode is typically controlled by software applications that may require it. For example, Wireshark can be configured to use promiscuous mode to listen to and process packets arriving on a NIC.

This can be useful for network monitoring and analysis. For example, when you want to use Wireshark or tcpdump to analyse packets.