My boss is making me nuts about this. We have a tablet with XP and a Realtec RTL8169/8110 Family network card in it. My boss has asked me to put the card into “promiscuous mode.” I actually don’t believe that doing so will achieve his desired result, but he won’t believe me until I can show it to him.
All the research that I have done shows a way to do this under Linux, but I’ll be darned if I can find a way to do it under XP. I even emailed Realtec’s tech support, but have not heard back from them.
Is it possible that under XP it is always in promiscuous mode? (Then the OS would have to check to see if the packets are addressed to it.)
Can anyone here point me to resources on how to do this? (Or tell me how?)
What is it that he is actually hoping to achieve? Is he hoping to be able to eavesdrop on general traffic on the whole network? - because that’s only really possible on a network that uses a hub, or a switch with a promiscuous port.
If the computer is attached to a fairly modern ethernet switch, rather than the older-fashioned and now largely obsolete hub, then incoming packets will only be for the specific machine anyway (except maybe a few things that are broadcast, but probably not very interesting)
We develop for the government and so I’m not sure what I’m allowed to say about what we are doing…
I think I can get away with saying that he is hoping to interface to a specific device whose manufacturers have told him needs a network card to be in promiscuous mode.
I have bullied him into arranging a meeting with me and them as it is my belief that he either misunderstood them or they are BSing him because they want to sell him something beyond the original device.
However, he has been like a bull dog on this topic. He fully believes that we need to put the network card into promiscuous mode. As I said earlier, I doubt that we will see the results he is expecting. OTOH I don’t know every damn thing and have been wrong before. So what the heck, if it can be done, I might as well do it.
Yes, it is definitely possible. As Quartz says, packet sniffing apps like Ethereal (now called Wireshark) and Windump both rely on operating network adapters in promiscuous mode. Adapters need to be supported, but I’d be amazed if yours wasn’t.
In fact I have exactly the same adapter you do (that chip’s very common indeed), and I think I have just stuck it in promiscuous mode using Wireshark. I say “I think” because it’s not plugged into anything (all wireless here), therefore I can’t see if the capture is actually working because there aren’t any packets to sniff. I’m reasonably confident it’s supported though.
I believe your card will only be in promiscuous mode while a Wireshark capture is running; running in promiscuous mode is pretty inefficient, so it’d be odd if the card were left in that state. Should you want to control it yourself, you could write your own program using the WinPCap libraries with which Wireshark is written. Doesn’t sound much fun to me, though.
I share your skepticism at this being necessary, anyway. Unless this device you’re talking about is also inside your computer, and is attempting to monitor network traffic on the adapter destined for machines other than the one it’s installed on, it’s very difficult to see a point in having the adapter set to promiscuous. And even if that were the case, I’d’ve expected the devices drivers or interface software to have dealt with it themselves.
If the device is external to the computer whose adapter you’re trying to set to promiscuous, then I have absolutely no idea what your boss thinks promiscuous mode is going to achieve, other than enabling packet sniffing. And then again, you’d need software to do that, and if you’ve had software supplied which requires a promiscuous card, it’d be very strange if it didn’t do it itself.
It sounds like he’s gotten a garbled message, to be honest (although obviously with so little detail to go on, this is just a semi-informed guess). Hope things clear up at your meeting.
