What is promiscuous mode for a NIC (interface)

What is promiscuous mode for a NIC (interface)

book

Article ID: CTX219263

calendar_today

Updated On:

Description

Question:

What is promiscuous mode for a NIC (interface)?

Answer:

In a network, promiscuous mode allows a network device to intercept and read each network packet that arrives in its entirety. 
In an Ethernet local area network (LAN), promiscuous mode is a mode of operation in which every data packet transmitted can be received and read by a network adapter.

Promiscuous mode must be supported by each network adapter as well as by the input/output driver in the host operating system.
Promiscuous mode is often used to monitor network activity.

Certain applications, such as network diagnostic or performance monitoring tools, might require visibility into the entire traffic passing across the PIF to which it is connected.

In the case of XenServer, a VM running within the hypervisor, by default, connects to a virtual switch (xenbr) that segments the network traffic between the PIF and the Virtual Network Interface (VIF) which is directly attached to the VM. Following the process outlined in this article permits all the traffic crossing the PIF to become transparent across the xenbr and visible to the VIF that the VM is plugged in to.

Example: 
Logs show "device eth12 entered promiscuous mode"

This means that eth12 can intercept and read any packet that arrives in the interface.

Issue/Introduction

What does it mean when logs show device eth entered promiscuous mode?

Additional Information

Certain applications, such as network diagnostic or performance monitoring tools, might require visibility into the entire traffic passing across the PIF to which it is connected.

In the case of XenServer, a VM running within the hypervisor, by default, connects to a virtual switch (xenbr) that segments the network traffic between the PIF and the Virtual Network Interface (VIF) which is directly attached to the VM. Following the process outlined in this article permits all the traffic crossing the PIF to become transparent across the xenbr and visible to the VIF that the VM is plugged in to.