GCIA · Question #74
You work as a Network Administrator in a company. The NIDS is implemented on the network. You want to monitor network traffic. Which of the following modes will you configure on the network…
The correct answer is A. Promiscuous. A NIC configured in promiscuous mode captures all packets on the network segment, which is required for a NIDS sensor to monitor traffic not addressed directly to the sensor host.
Question
You work as a Network Administrator in a company. The NIDS is implemented on the network. You want to monitor network traffic. Which of the following modes will you configure on the network interface card to accomplish the task?
Options
- APromiscuous
- BAudit mode
- CFull Duplex
- DHalf duplex
How the community answered
(33 responses)- A79% (26)
- B6% (2)
- C3% (1)
- D12% (4)
Why each option
A NIC configured in promiscuous mode captures all packets on the network segment, which is required for a NIDS sensor to monitor traffic not addressed directly to the sensor host.
Promiscuous mode disables the NIC's default behavior of silently discarding frames not addressed to its own MAC address, allowing it to forward all captured frames to the OS for inspection. This is essential for NIDS operation because the sensor must analyze all traffic flowing through the segment, not just traffic explicitly destined for the sensor itself.
Audit mode is not a recognized NIC operating mode and has no effect on whether the interface captures traffic beyond its assigned MAC address.
Full duplex is a link-level transmission setting that enables simultaneous send and receive, but it does not control whether the NIC processes frames addressed to other hosts.
Half duplex restricts transmission to one direction at a time and has no bearing on the NIC's ability to capture all traffic on a segment for monitoring purposes.
Concept tested: NIC promiscuous mode for NIDS traffic capture
Source: https://docs.snort.org/start/installation
Topics
Community Discussion
No community discussion yet for this question.