GSLC · Question #371
The promiscuous mode is a configuration of a network card that makes the card pass all traffic it receives to the central processing unit rather than just packets addressed to it. Which of the…
The correct answer is A. Sniffer. A packet sniffer works by placing the host's network interface card into promiscuous mode, allowing it to capture all network traffic regardless of the destination address.
Question
The promiscuous mode is a configuration of a network card that makes the card pass all traffic it receives to the central processing unit rather than just packets addressed to it. Which of the following tools works by placing the host system network card into the promiscuous mode?
Options
- ASniffer
- BTHC-Scan
- CNetStumbler
- DSnort
How the community answered
(19 responses)- A95% (18)
- B5% (1)
Why each option
A packet sniffer works by placing the host's network interface card into promiscuous mode, allowing it to capture all network traffic regardless of the destination address.
A network sniffer (packet analyzer) is specifically designed to set the NIC into promiscuous mode, which causes the card to pass all frames it receives to the CPU instead of discarding frames not addressed to the host. This enables capture and analysis of all traffic on the network segment, which is the defining operational characteristic of sniffers.
THC-Scan is a war-dialing tool used to scan telephone numbers for modem connections and does not operate by placing a NIC into promiscuous mode.
NetStumbler is a wireless network discovery tool that detects 802.11 access points and does not rely on promiscuous mode NIC operation.
Snort is a network intrusion detection and prevention system; while it may read from an interface, its primary function is signature-based threat detection, not promiscuous-mode packet capture for analysis.
Concept tested: Promiscuous mode and packet sniffers
Source: https://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/10570-41.html
Topics
Community Discussion
No community discussion yet for this question.