In Wireless Networks, you can put your wireless card in Promiscuous or in Monitor Mode.

What is the difference between these two modes ?

2 Answers 2

  • Monitor mode: Sniffing the packets in the air without connecting (associating) with any access point.

    Think of it like listening to people's conversations while you walk down the street.

  • Promiscuous mode: Sniffing the packets after connecting to an access point. This is possible because the wireless-enabled devices send the data in the air but only "mark" them to be processed by the intended receiver. They cannot send the packets and make sure they only reach a specific device, unlike with switched LANs.

    Think of it like joining a group of people in a conversation, but at the same time being able to hear when someone says "Hey, Mike, I have a new laptop". Even though you're not Mike, and that sentence was intended to be heard by Mike, but you're still able to hear it.


Promiscuous Mode:

Capture packets on a network that you have connected to. This is likely what you need to be in if you want to analyze packets (Wireshark, tcpdump, etc.)

Monitor Mode:

Capture packets regardless of connected network. No association to AP needed (and no authentication). Because it is not connected to a network, you can't process the Ethernet info.



You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .