# promiscous mode question

## queen

I have some questions regarding promiscous mode. 

1. Wireshark, kismet  and other programs put automatically the wifi card into promiscous mode. Is it due to setting of promiscous mode in the kernel or it can do without it?

2. Why my wifi card disconnects from internet when the card enters into promiscous mode?

----------

## eccerr0r

Promiscuous mode means the network adapter will listen to all data coming in - else it will filter out all packets not addressed to it (and save interrupts/cpu processing time).  It's a kernel mode as the kernel needs to then make sure all packets go to where they need to go.

So, that just leaves #2 unanswered, and this is probably due to a broken or incompatible driver.

----------

## queen

 *eccerr0r wrote:*   

> Promiscuous mode means the network adapter will listen to all data coming in - else it will filter out all packets not addressed to it (and save interrupts/cpu processing time).  It's a kernel mode as the kernel needs to then make sure all packets go to where they need to go.
> 
> So, that just leaves #2 unanswered, and this is probably due to a broken or incompatible driver.

 

The card is intel 

```
01:07.0 Network controller: Intel Corporation PRO/Wireless 2200BG Network Connection (rev 05)
```

I use the ipw2200 driver. the card is detected fine. 

Can it be due to internet problems? I have some problems with the internet, in one of the switches of the infrastructure I have 80% packet loss. Haven't solved this issue with cable company, yet ;-(

----------

## eccerr0r

What do you mean by 'disconnect' - I can run tcpdump on my ipw2200 wifi card just fine, which also places the network adaptor in promiscuous mode.  It should not cause total connectivity loss, but I'm not sure if there would be any bad interaction from WPA/WPA2, etc. (I'm not using WPA, but I don't think it should matter)...

----------

## queen

 *eccerr0r wrote:*   

> What do you mean by 'disconnect' - I can run tcpdump on my ipw2200 wifi card just fine, which also places the network adaptor in promiscuous mode.  It should not cause total connectivity loss, but I'm not sure if there would be any bad interaction from WPA/WPA2, etc. (I'm not using WPA, but I don't think it should matter)...

 

ping google.com and I don't get anything. can't browse. After ctrl+c of the ping I see 100% packet loss. Can you browse the internet while you use kismet/wireshark or any of those programs that put the card in promiscous mode. 

Maybe something in my /etc/conf.d/net is wrong? How your file looks? I don't use wpa or wep. Yet another problem I have to solve after that.

----------

## Cyker

IIRC, things like kismet take exclusive control of the WiFi when they are scanning because they are accessing the NIC directly, so any higher-layers like TCP/IP can't access the card.

Or something like that.

For given values of 'like'.

Promiscuous mode shouldn't necessarily stop the 'net working. ALL the NICs on my system run in Promiscuous mode all the time for instance (They're part of an ethernet bridge).

----------

## queen

 *Cyker wrote:*   

> IIRC, things like kismet take exclusive control of the WiFi when they are scanning because they are accessing the NIC directly, so any higher-layers like TCP/IP can't access the card.
> 
> Or something like that.
> 
> For given values of 'like'.
> ...

 

So, why it stops the networking in my case? bad definition in the /etc/conf.d/net? Or something in the kernel? 

Here is my 

```
config_eth0=("dhcp")

#dhcp_eth0="nontp nonis nodns"

dhcp_eth0="nontp nonis"

#dns_servers_eth0="127.0.0.1 208.67.222.222 208.67.220.220"

config_eth2=("dhcp")

modules_eth2=("iwconfig")

#dhcp_eth2="nodns"

#dns_servers_eth2="208.67.222.222 208.67.220.220"

routes_eth2=("default gw 192.168.1.1")

dhcp_eth2="nontp nonis"

```

----------

## eccerr0r

I just read the kernel config:

```
config IPW2200_MONITOR

        bool "Enable promiscuous mode"

        depends on IPW2200

        ---help---

          Enables promiscuous/monitor mode support for the ipw2200 driver.

          With this feature compiled into the driver, you can switch to 

          promiscuous mode via the Wireless Tool's Monitor mode.  While in this

          mode, no packets can be sent.

```

This seems a bit different more of promiscuity than the usual ethernet promiscuous mode.  I'm not certain I have this  mode on, been just sniffing my own ethernet over wireless packets, not all wifi packets (including wifi packets not destined to you)...

----------

## queen

 *eccerr0r wrote:*   

> I just read the kernel config:
> 
> ```
> config IPW2200_MONITOR
> 
> ...

 

I have it enabled in the kernel. 

```
 grep -i promi /usr/src/linux/.config

CONFIG_IPW2200_PROMISCUOUS=y

```

I think this might be the problem in my case. I don't use the wireless tool's monitor.

----------

