nerdexam
EC-Council

312-49 · Question #442

Sniffers that place NICs in promiscuous mode work at what layer of the OSI model?

The correct answer is C. Physical. In some exam frameworks, sniffers that place NICs in promiscuous mode are classified as operating at the Physical layer (Layer 1) because promiscuous mode causes the NIC to capture all signals on the physical medium without any MAC address filtering - essentially reading every…

Submitted by yuki_2020· Apr 18, 2026Network Forensics

Question

Sniffers that place NICs in promiscuous mode work at what layer of the OSI model?

Options

  • ANetwork
  • BTransport
  • CPhysical
  • DData Link

How the community answered

(27 responses)
  • A
    4% (1)
  • C
    93% (25)
  • D
    4% (1)

Explanation

In some exam frameworks, sniffers that place NICs in promiscuous mode are classified as operating at the Physical layer (Layer 1) because promiscuous mode causes the NIC to capture all signals on the physical medium without any MAC address filtering - essentially reading every bit transmitted on the wire. Note: Technically, many networking authorities classify packet sniffing at the Data Link layer (Layer 2) since frames carry MAC addresses. However, in the context of this exam, the rationale is that the NIC bypasses all normal Layer 2 filtering and captures raw traffic at the physical medium level, making Physical layer the intended answer.

Topics

#Sniffing#Promiscuous Mode#OSI Model#Network Interface Card

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice