Capture All Traffic in Promiscuous Mode

Topic Overview

What Promiscuous Mode Does

Normally a NIC delivers only frames addressed to its MAC, broadcast (ff:ff:ff:ff:ff:ff), or subscribed multicast groups. Promiscuous mode removes that filter so every frame on the wire reaches user space. For example, you might see ARP exchanges between 192.168.1.1 and other hosts even though neither endpoint is your machine.

Enabling It on Linux

Two common paths:

• AF_PACKET socket + setsockopt(PACKET_ADD_MEMBERSHIP, PACKET_MR_PROMISC)
• libpcap's pcap_open_live() with promiscuous flag enabled

Both require root or CAP_NET_RAW. On a switched network you still mostly see broadcast and flooded traffic unless you use port mirroring or ARP spoofing.

Promiscuous vs Monitor Mode

• Promiscuous: wired Ethernet, standard frames with EtherType 0x0800
• Monitor: wireless only, raw 802.11 management and control frames

In normal mode your NIC might deliver only a few hundred frames per second addressed to its MAC. In promiscuous mode on a busy hub or mirrored switch port, you could see thousands of frames per second including ARP broadcasts, DHCP offers, and unicast traffic between other hosts on 192.168.1.0/24.

Why This Exercise

This task asks you to document promiscuous mode setup and simulate receiving packets. libpcap uses this exact PACKET_MR_PROMISC path under Wireshark and tcpdump, and understanding it explains why switched networks limit what you can sniff without extra techniques. The 2010 Firesheep tool demonstrated how much session data was exposed on shared Wi-Fi networks when anyone could capture HTTP cookies in promiscuous mode.

Implement a C program that classifies frames captured in promiscuous mode and computes sniffer statistics.

Input (stdin, whitespace-separated):

• N, the number of captured frames
• N lines of: destination MAC (12 hex characters) and frame length in bytes

Requirements:

• Parse each destination MAC into 6 bytes
• Classify every frame: broadcast if the MAC is ff:ff:ff:ff:ff:ff, multicast if the low bit of the first byte (the I/G bit) is set, otherwise unicast
• Print one verdict line per frame, then the totals line exactly as specified
• A frame is "missed in normal mode" when it is neither broadcast nor addressed to this station's MAC; the NIC hardware filter would drop it without promiscuous mode

Output format:

• Per frame: "frame I broadcast" | "frame I multicast" | "frame I unicast" (I = zero-based index)
• Last line: captured=N broadcast=B unicast=U bytes=T (T = sum of all frame lengths)

Success Criteria:

• Broadcast, multicast, and unicast are distinguished by MAC bits, not by string matching
• Totals include every frame and the byte count
• The classification logic mirrors what the NIC hardware filter does before PACKET_MR_PROMISC lifts it