Capture only local traffic - disable promiscuous mode

Oct 28, 2014 at 4:20 PM
Hi all,

is there a way to disable promiscuous mode in the code? I understand that I can control this using PacketDeviceOpenAttributes but which setting should I choose. I tried with None but it does not seem to work.

I'm using WinPcap 4.1.3 and Pcap.Net 1.0.1.75541 on Windows 7.

Thanks
Coordinator
Nov 1, 2014 at 6:03 AM
Hi McMallar,

From the documentation of the Promiscuous bit in Pcap.Net:
        /// Defines if the adapter has to go in promiscuous mode.
        /// Note that even if this parameter is false, the interface could well be in promiscuous mode for some other reason
        /// (for example because another capture process with promiscuous mode enabled is currently using that interface).
This is WinPcap's behavior.

I hope this helps,

Boaz.
Nov 1, 2014 at 8:29 AM
Hi Boaz,

Thanks for your comment. I downloaded and read the mentioned documentation and I noted the comment you pasted. What I am trying to figure out is, whether I can fix (looks not) or at least detect in what mode the adapter is. As you might know, promiscuous mode in enterprise environments is forbidden and easily detected so I would not want to get in trouble. I'm only interested in DNS traffic which I can filter out by port, for example but I should not even capture any traffic destined for other computers.

Any ideas on this?

Thanks,
Peter
Coordinator
Nov 1, 2014 at 8:34 AM
Hi Peter,

One idea I can think of is to filter out packets that aren't intended for your computer according to their Ethernet destination address.

Boaz.
Nov 1, 2014 at 9:18 AM
Hi Boaz,

unfortunately this would not work for me due to promiscuous mode being detected inside the enterprise by network guys. I can afford to run this at home but not inside the company. In short, filtering after the capture is a no-go...

Peter
Coordinator
Nov 1, 2014 at 5:42 PM
Hi Peter,

I'm not sure if using the driver based filter would still be considered considered filtering after the capture.
If it does, and WinPcap still captures in promiscuous mode even though you didn't turn promiscuous mode on, I don't know how to help.
You might want to ask WinPcap experts if it is possible to disable promiscuous mode in this case.

Boaz.