As an attacker,how do I prevent people from finding out that my NIC is in promiscuous mode? For test like ARP and DNS how do I defeat the users detection mechanism?
- There is a possibility that Promiscuous mode can be detected by another device on the network!
- You can/must configure your sniffer tool/software so that it doesn't allows to detect if you are in promiscuous mode. For that you have to configure your sniffer tool so that your machine doesn't reply to the packets/requests that are usually used to detect the Promiscuous mode. Here you can read how the promiscuous mode can be detected. However the feature, that not to respond to the requests(Specially crafted packets to determine the promiscuous mode) depends if it is available in your sniffer tool.
Promiscuous mode is a passive state so it cannot be detected by the network on its own. Of course once you start doing your "hacking" actively, the network may detect you but that wouldn't be detection of promiscuous but rather a rogue node.
Why? In passive mode the NIC just doesn't drop the packets that would come to it anyway. The dropping is silent so in any case there is no feedback to the network.