Ask Your Question
0

How to set promiscuous mode and determine inbound traffic

asked 2021-05-05 10:35:46 +0000

gapwalker gravatar image

updated 2021-05-05 11:42:53 +0000

grahamb gravatar image

https://ufile.io/l9xqze2v wireshark.pcap
iptables.sh https://ufile.io/v9hsadna
Look at my iptables which config will drop traffic in wireshark
How to configure promiscous and understand which traffic is inbound of wireshark or inbound at all?

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2021-05-05 11:47:43 +0000

grahamb gravatar image

To determine inbound traffic you should disable promiscuous mode as that allows traffic that wouldn't normally be accepted by the interface to be processed. This is done from the Capture Options dialog.

To determine inbound traffic, set a display filter to only show traffic with a destination of your interface(s) MAC addresses(es), e.g.

eth.dst == 00:11:22:33:44:55

substituting the appropriate value for your NIC MAC.

edit flag offensive delete link more

Comments

How to understand how much invisible interfaces in physical level !?
And how much linux network interfaces in standart mode ?
Whear i can download pcap on arp protocol and how much protocols working behind linux iptables drop all script without arp?
And how to understand is this promiscuous traffic is dropped which goes through interface and wireshark ?

gapwalker gravatar imagegapwalker ( 2021-05-05 12:46:58 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2021-05-05 10:35:46 +0000

Seen: 1,172 times

Last updated: May 05 '21