An administrator is capturing traffic with Wireshark and is only seeing ARP traffic. What is the most likely cause of this?

While promiscuous mode allows an interface to capture all traffic it *sees*, on a switched network, the interface still won't see unicast traffic destined for other hosts unless port mirroring is configured.

In a switched network environment, a network switch intelligently forwards unicast traffic only to the port where the destination MAC address resides. Therefore, a sniffing station on a switched network will naturally only see its own unicast traffic, as well as broadcast and multicast traffic (like ARP requests, DHCP, etc.), unless specific techniques like port mirroring (SPAN) are employed.

Wireshark captures all packets by default (or based on capture filters), regardless of whether specific protocols like TCP and UDP are explicitly 'enabled'.

There is no standard 'ARP_ONLY flag' that can be set on a network interface to restrict it to only ARP traffic; this is a fictitious setting.