You have set up a local area network for your company. Your firewall separates your network into several sections: a DMZ with semi-public servers (web, dns, email) and an intranet with private…

A router in the private section would not flood all traffic to all ports, so the sniffer could not capture traffic for all devices; this contradicts the observed behavior.

Because the sniffer in the private section captured all device traffic, the private section uses a hub - which floods every frame out all ports. Because the sniffer in the DMZ captured only its own device's traffic, the DMZ uses a switch - which forwards frames only to the MAC-addressed destination port, preventing promiscuous-mode capture of other devices' traffic.

A switch in the private section would prevent the sniffer from seeing other devices' traffic, and a hub in the DMZ would allow the sniffer to capture all DMZ traffic - the opposite of what was observed.

A router in the DMZ would not cause the observed sniffing limitation; routers operate at Layer 3 and segment broadcast domains rather than enabling or disabling promiscuous sniffing the way a switch does.