What is the advantage(s) (besides the possibility to alter network traffic) of using MITM techniques over just sniffing in promiscuous mode?


On a switched network, promiscuous mode does not show you any additional traffic because the network switch will only forward packets destined for your MAC address to your port on the switch. In the case of a MITM, you can use ARP spoofing or other MITM techniques to get clients to connect through you, such that you can see their traffic.

As you point out, a MITM can also conduct active attacks (tamper/modify/drop traffic) to further benefit their objectives.

| improve this answer | |
  • Oh ok, i thought that the promiscuous mode forces the switch to act like a hub... Than you ! – Neolex Jan 23 '18 at 7:47
  • 1
    Promiscuous mode in nic settings set your nice to not drop foreign traffic. SO if you can configure your switch port to port mirroring, then the promiscuous mode will let your monitor device to catch all the mirrored port. – Yehuda Jan 23 '18 at 9:27
  • 7
    @Neolex Promiscuous mode is a setting on your computer - it doesn't change anything in how the switch routes traffic, it just means that your computer won't ignore traffic it receives that is addressed to other people. Getting other people's traffic to arrive at your computer is another matter. – anaximander Jan 23 '18 at 14:58

There are many cases where MITM is better. For example, if Diffie-Hellman key exchange is involved, the encrypted traffic can still be accessed via MITM, but not by sniffing.

| improve this answer | |
  • 2
    How is that if you don't alter the network traffic? (Altering the network traffic is explicitly excluded in the question) – marcelm Jan 23 '18 at 19:54
  • Diffie Helman makes clever use of primes to establish a shared secret between two parties without needing to communicate that secret. – Adam Luchjenbroers Jan 24 '18 at 6:43
  • @AdamLuchjenbroers I know how DH key exchange works; an attacker cannot learn the secret from passive (listen-only) attacks, only by altering the traffic (violating the authenticity requirement for DH to work). But that brings me back to my question: altering the traffic was excluded by the OP, so how is the answer relevant? – marcelm Jan 26 '18 at 22:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.