Skip to main content
2 of 3
spelling fix
Neil Smithline
  • 14.9k
  • 4
  • 40
  • 55

Is promiscuous mode sufficient to sniff packets in a wifi network?

I'm connected to my WiFi network and I want to capture and analyze packets that other clients are exchanging with the gateway. I don't want to modify the content of these packets and I don't need to read the content of every packet.

Actually, the wlan configuration is the following:

  • a router 192.168.1.1
  • the laptop that I'm using to sniff traffic 192.168.1.9
  • my smartphone 192.168.1.2

so I want to be able to see (part of) the traffic between my smartphone and the router.


To achieve the goal I set the wireless interface in promiscuous mode with sudo ip link wlo1 promiscuous on and I check if it is enabled with netstat -i:

Kernel Interface table
Iface   MTU Met   RX-OK RX-ERR RX-DRP RX-OVR    TX-OK TX-ERR TX-DRP TX-OVR Flg
enp8s0     1500 0     28962      0      1 0         22923      0      0      0 BMU
lo        65536 0      7294      0      0 0          7294      0      0      0 LRU
wlo1       1500 0     29469      0      0 0         12236      0      0      0 BMPRU

The P on the flag column indicates the promiscuous mode, so I'm assuming it is enabled. Since the promiscuous mode is on, I should see all the traffic that my NIC can capture. Then I open wireshark and I start to capture traffic on wlo1 interface but I don't see any packets from source 192.168.1.2 and I'm surfing the net with my smartphone (so, I'm generating traffic).

What am I doing wrong?

user113574