Promiscuous Monitoring in Ethernet and Wi-Fi Networks

Promiscuous Monitoring
in Ethernet and
Wi-Fi Networks Executive Summary This white paper examines the problems related to the deployment and usage of software-based network monitoring solutions in wired and wireless Ethernet Local Area Networks (LANs). It demonstrates the methods of achieving network traffic visibility in various network configurations, explains important network monitoring concepts, and describes solutions to the typical problems encountered by network administrators in setting up network monitoring software.
Copyright © 2005 TamoSoft All Rights Reserved. No part of this work can be reproduced or duplicated in any form without the expressed written permission of TamoSoft. Contents What Is Promiscuous Monitoring ......................................................................... 3 Practical Applications ........................................................................................ 3 Ethernet Networks, Hubs and Switches ................................................................. 3 Monitoring Using Hubs....................................................................................... 4 Hubs: Potential Problems ................................................................................... 6 Read-Only Cables.............................................................................................. 6 Monitoring Using Switches.................................................................................. 7 Port Mirroring Configuration ............................................................................... 8 Best Practices .................................................................................................. 9 Monitoring Across WAN...................................................................................... 9 Wi-Fi (802.11) Networks .................................................................................... 9 Conclusion..................................................................................................... 11 About TamoSoft.............................................................................................. 12
2What Is Promiscuous Monitoring In the realm of computer networking, promiscuous mode refers to the special mode of Ethernet hardware, in particular network interface cards (NICs), that allows a NIC to receive all traffic on the network, even if it is not addressed to this NIC. By default, a NIC ignores all traffic that is not addressed to it, which is done by comparing the destination address of the Ethernet packet with the hardware address (a.k.a. MAC) of the device. While this makes perfect sense for networking, non-promiscuous mode makes it difficult to use network monitoring and analysis software for diagnosing connectivity issues or traffic accounting. In a wider sense, promiscuous mode also refers to network visibility from a single observation point, which doesn't necessarily have to be ensured by putting network adapters in promiscuous mode. Modern hardware and software provide other monitoring methods that lead to the same result. In this white paper, we'll discuss the techniques that are commonly used to ensure network visibility in different network environments, both wired and wireless, equipped with different kinds of hardware. Practical Applications So why would we need to monitor anything other than our own computer? Simply put, in a situation where your network consists of three computers, A, B, and C, and the network analyzer is running on computer A, you should be able to see not only the data being sent from/to computer A, but also the data being sent from B to C. This is practical if you use network analyzers, traffic accounting systems, content monitoring systems, and similar applications. In theory, you could run a monitoring application on each computer, but it's inconvenient, as you wouldn't have the complete picture in front of you. This white paper was written to address frequently asked questions by the users of TamoSoft products CommView and CommView for WiFi, network analyzers for wired and wireless networks, CommTraffic, a traffic accounting system, and NetResident, a content monitoring system. However, the monitori... [download for more]