configuring MacBook Pro to promiscuous mode

chscag

Well-known member
Staff member
Admin
Joined
Jan 23, 2008
Messages
65,248
Reaction score
1,833
Points
113
Location
Keller, Texas
Your Mac's Specs
2017 27" iMac, 10.5" iPad Pro, iPhone 8, iPhone 11, iPhone 12 Mini, Numerous iPods, Monterey
Thanks Nick. Learn something new all the time.

To the OP:

How about telling us exactly what it is you want to do and some info about your hardware would help. Also this post probably belongs in networking.
 

pigoo3

Well-known member
Staff member
Admin
Joined
May 20, 2008
Messages
44,210
Reaction score
1,418
Points
113
Location
U.S.
Your Mac's Specs
2017 15" MBP, 16gig ram, 1TB SSD, OS 10.15
I would say that the one area of computing that I would like to learn more about is networking…so I was surprised to find that this term was computer networking related.

- Nick
 
Joined
Jul 24, 2013
Messages
5,073
Reaction score
758
Points
113
Location
Ohio (USA)
Your Mac's Specs
2023-14" M3max MBPro, 64GB/1TB, iPhone 15 Pro, Watch Ultra
Okay, If the OP is trying to run a packet sniffer/capturing software they will probably need to run it in promiscuous mode.

Promiscuous mode allows you to view all wireless packets on a network to which you have associated. The need to associate means that you must have some means of authenticating yourself with an access point. In promiscuous mode, you will not see packets until you have associated. Not all wireless drivers support promiscuous mode.

Here is a link that gives a lot more information:

High on Wires: Difference - Promiscuous vs. Monitor Mode (Wireless Context)

I ran into this running wireshark which is a packet sniffer. Your network adapter must be able to switch to promiscuous mode. All the programs that use it that I have run will automatically switch the mode for you if the adapter can do it. Not all will.

If there is a way to change it from one mode (monitor to promiscuous) I have no idea how to do that.

Lisa
 

chscag

Well-known member
Staff member
Admin
Joined
Jan 23, 2008
Messages
65,248
Reaction score
1,833
Points
113
Location
Keller, Texas
Your Mac's Specs
2017 27" iMac, 10.5" iPad Pro, iPhone 8, iPhone 11, iPhone 12 Mini, Numerous iPods, Monterey
Not appropriately, that's why it disappeared along with my mistaken post. Now if you want to get your question answered, press on, if not, let us know.
 

pigoo3

Well-known member
Staff member
Admin
Joined
May 20, 2008
Messages
44,210
Reaction score
1,418
Points
113
Location
U.S.
Your Mac's Specs
2017 15" MBP, 16gig ram, 1TB SSD, OS 10.15
Okay, If the OP is trying to run a packet sniffer/capturing software they will probably need to run it in promiscuous mode.

Promiscuous mode allows you to view all wireless packets on a network to which you have associated. The need to associate means that you must have some means of authenticating yourself with an access point. In promiscuous mode, you will not see packets until you have associated. Not all wireless drivers support promiscuous mode.

I ran into this running wireshark which is a packet sniffer. Your network adapter must be able to switch to promiscuous mode. All the programs that use it that I have run will automatically switch the mode for you if the adapter can do it. Not all will.

In your experience (in lay-person's words)...what's the most common reason/function for using this "promiscuous mode"? Or what is someone most likely trying to accomplish by doing it?

Thanks,

- Nick
 
Joined
Apr 26, 2008
Messages
2,963
Reaction score
120
Points
63
Location
Belgium
Your Mac's Specs
iPad Pro 12.9 latest iOS
Promiscious mode is a setting on network cards, not an OS setting.
It is used to intercept full/fragmented network packets and hand them over to a network monitoring software, usually a sniffer.
Most network monitoring applications are capable of putting a network card in promiscuous mode when you launch the application.
It creates a bit of overhead on the network card in terms of latency, but not much.

In summary ..... " I want to see exactly which network packets are moving around on my network ..... source, destination, protocol, and content ( if not encrypted ) "


@FentonLawless, what exactly are you trying to achieve ( the problem ) , there may be other ways to help.

Cheers ... McBie
 
OP
F
Joined
Jun 23, 2013
Messages
12
Reaction score
0
Points
1
Thanks Iclev

I now understand that a network card is not in OS, but how do I access it and change it in a macbook pro? Thanks again.
 
OP
F
Joined
Jun 23, 2013
Messages
12
Reaction score
0
Points
1
In summary ..... " I want to see exactly which network packets are moving around on my network ..... source, destination, protocol, and content ( if not encrypted ) (or if encrypted) On my network. Which is mine.
 
Joined
Apr 26, 2008
Messages
2,963
Reaction score
120
Points
63
Location
Belgium
Your Mac's Specs
iPad Pro 12.9 latest iOS
Mate, helping each other is a 2 way street ..... it takes 2 hands to clap.

I provided a solution in my post above ( network monitoring apps can switch a card into promiscuous mode ), but I also asked a question ( what are you trying to achieve ).
You are giving us very little opportunity to help by jumping straight into the " solution space " without explaining the " problem space ".

Maybe there are other solutions available for the issue on hand.

Cheers ... McBie
 
Joined
Apr 26, 2008
Messages
2,963
Reaction score
120
Points
63
Location
Belgium
Your Mac's Specs
iPad Pro 12.9 latest iOS
In summary ..... " I want to see exactly which network packets are moving around on my network ..... source, destination, protocol, and content ( if not encrypted ) (or if encrypted) On my network. Which is mine.

Correction .... not just on your network, but any network you are connected to, which opens up a whole new discussion mate.

And just to be clear, with the attitude you are currently taking on, people who are likely to help you find a solution will disconnect.

Cheers ... McBie
 
OP
F
Joined
Jun 23, 2013
Messages
12
Reaction score
0
Points
1
Goal

To monitor internet traffic on my home network. I am, or trying, to use wireshark, but I can only "sniff" posts from the computer wireshark is installed on. I am being told to put my network cards into "promiscuous mode", but I don't know how to do that. This, reputedly will solve my problem. BTW, Wireshark does not automatically switch to "pro mode" as suggested.
Thanks.
 
Joined
Apr 26, 2008
Messages
2,963
Reaction score
120
Points
63
Location
Belgium
Your Mac's Specs
iPad Pro 12.9 latest iOS
The ability to capture only packets on the computer that Wireshark is installed on may be related to the fact that you are using a switch to connect all your devices. A switch is intelligent and routes packets directly from source to destination using the appropriate port on the switch. A switch will not relay network packets from one segment onto another unless it can reach its destination that way.
That is why you are seeing only packets from devices on the segment your computer is physically connected to.
If you want to sniff your whole network at home, you need to configure the switch to forward all packets from other ports onto the port where your wireshark computer is connected on.
Beware .... you will be loading the CPU in the switch a lot and as a result, the network might slow down a lot.

Wireshark will not automatically put the cards in promiscuous mode, you need to tick a box in the wireshark application to make that happen. ( If I am not mistaken, it has been a while since I diagnosed networks )

Cheers ... McBie
 
Last edited:
OP
F
Joined
Jun 23, 2013
Messages
12
Reaction score
0
Points
1
No switch . . .

just a time capsule with airport. I'm reading 7 year old postst about changing the security to WEP, but I don't have thaI t option. I'm kind of shocked that I could be that rare case of not being able to utilize Wireshark. It comes so highly recommended. And I still have no clue how to configure into "pro mode". On wireshark, yes. My network cards, no.
Hey thanks very much for your efforts.
 
Joined
Jul 24, 2013
Messages
5,073
Reaction score
758
Points
113
Location
Ohio (USA)
Your Mac's Specs
2023-14" M3max MBPro, 64GB/1TB, iPhone 15 Pro, Watch Ultra
In your experience (in lay-person's words)...what's the most common reason/function for using this "promiscuous mode"? Or what is someone most likely trying to accomplish by doing it?

Thanks,

- Nick

I use it to monitor activity on my network. You can see a lot. If you have a ton of activity from a computer you know you have a problem and can address it. (I am trying to keep this simple ;) ) A program like wire shark will show you the IP addresses, type of transmission, and it will even show unencripted passwords! If your network is getting slammed and is crawling this is very helpful for finding the offending problem or protocol and shutting it down. It is also a favorite of the hacker community - sadly. :(

Basically the program will change the adapter over to "promiscuous" mode. Think of the mode as opening your adapter to suck up all the activity going on in the network. When you normally use your adapter you don't really need it monitoring all the flow on your network you just want the packets your computer requested for you.

There are a variety of programs that do all kinds of network exploration but you requested the simplified form. ;)


Lisa

WiresharkCapture.JPG
 

Shop Amazon


Shop for your Apple, Mac, iPhone and other computer products on Amazon.
We are a participant in the Amazon Services LLC Associates Program, an affiliate program designed to provide a means for us to earn fees by linking to Amazon and affiliated sites.
Top