ethereal... how does it work..

[chandan820]

I know it turns the NIC into promiscous mode and sucks all the information and displays them. But, my question is how to set a NIC to promiscous mode . . . . . . the implementation concept!!
Thats all

[craig_mcd]

ifconfig <interface> promisc

That turns the <interface> to promiscuous mode.
I would guess that ethereal does it a lower level than that though.

[Dolda2000]

Ethereal probably uses the same socket ioctl that ifconfig does. However, it is important to note that promiscuous mode isn't what you use to suck packets from the interface; for that you mainly just use a raw socket. Promiscuous mode enables the NIC to pass all packets through to the kernel, even those that wasn't intended for your MAC address. That means that if you're using a switch, promiscuous makes no difference, but if you're using a hub, you can listen to other computers' conversations as well.