Why does Wireshark detect activity from my Win11 laptop connected to a network tap?

asked 2025-09-23 18:03:32 +0000

I read that the ethernet port would be automatically disabled to traffic and put into promiscuous mode for listening purposes in the instructions.

Somehow I got back that my Wireshark machine did a host announcement and sent standard query responses directed at hosts outside my network.

Did I read the theory of operation wrong or were the instructions on the Sharktap lying too?

Really seems odd to me!

answered 2025-09-23 19:28:00 +0000

SYN-bit

18600 ●9 ●365 ●255 https://SYN-b.it

I can not comment on the Sharktap instructions, as those are third-party (do you have a link to the instructions?). As for the interface of the capturing system, promiscuous mode only means packets that would normally be dropped at the NIC (unicast packet not for it's own mac-address and multicast packets for groups that the nic was not subscribed to) will now be forwarded to the OS. There is no mechanism in the capturing host that prevents outgoing packets. Unless you remove the networking stacks from the interface of course.

edit flag offensive delete link

Comments

https://midbittech.com/usb/USB%20Star...

There's the link. You read it.

Kerry is me ( 2025-09-23 21:33:20 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Why does Wireshark detect activity from my Win11 laptop connected to a network tap?

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Why does Wireshark detect activity from my Win11 laptop connected to a network tap? edit

1 Answer

Comments