An administrator is capturing traffic with Wireshark and is only seeing ARP traffic. What is the most likely cause of this?

While promiscuous mode allows an interface to capture all traffic it receives, it doesn't bypass the fundamental behavior of a network switch, which directs unicast traffic only to the intended port.

In a switched network environment, a standard host typically only receives unicast traffic specifically destined for its MAC address, along with broadcast and multicast traffic. Since ARP (Address Resolution Protocol) requests are broadcast, the capturing machine will see them, but it will not see other unicast TCP/UDP traffic between other hosts unless a port mirroring (SPAN) or TAP device is used, or the capturing machine is the actual source or destination of that traffic.

Wireshark captures all traffic types by default unless a capture filter is specifically applied to restrict protocols, so not enabling TCP/UDP options is not a valid reason.

There is no standard 'ARP_ONLY' flag for a network interface that would restrict it to only ARP traffic in the way described.