Wireshark Promiscuous Mode on Windows: Capturing Non-Local Traffic

When you want to capture Ethernet traffic other than Unicast traffic going to or from the host running Wireshark, Multicast traffic, and Broadcast traffic, your adapter needs to be put in promiscuous mode. This allows the filter mentioned above to be switched off, and all received packets are delivered to the host. The driver for the adapter will also send copies of transmitted packets to the packet capture mechanism, allowing a capture program like Wireshark to see them.

In order to capture Multicast traffic on an Ethernet network, you need to put your adapter in promiscuous mode. This allows you to capture all Multicast packets that are being sent to a specific Multicast address for that adapter or all Multicast packets regardless of the address they're being sent to. Some network adapters can be configured to accept packets for specific Multicast addresses while others deliver all multicast packets to the host for it to filter.

The Ethernet hardware on your network adapter filters received packets and delivers only Unicast packets going to one of the adapter's addresses to the host. This means you need to capture in promiscuous mode if you want to see traffic between two or more other machines on an Ethernet segment, especially on a switched Ethernet network where you'll have to set up your machine specially to capture that traffic.

If you're trying to capture network traffic that's not being sent to or from the machine running Wireshark or TShark, such as network traffic from that machine to itself, you'll need to capture on a loopback interface if that's possible. On the other hand, if you're only trying to capture network traffic between the machine running Wireshark or TShark and other machines on the network, you can do this by capturing on the network interface through which the packets will be transmitted and received with no special setup needed.

This article provides points to consider when capturing packets from Ethernet networks. By understanding how promiscuous mode works in Wireshark, you'll be able to capture non-local traffic with ease.

Wireshark promiscuous mode windows