 | | In order to monitor the network, a network monitoring program has to be able to place the system's network interface(s) into promiscuous mode. In this mode, the network interface copies all packets from the network rather than just those that are destined for the local host. The operating system must then arrange for the monitoring program to be given a copy of all of these packets. While it's doing that, though, it also has to continue processing all the packets addressed to it in the normal fashion, or else turning on a network monitor would turn off everything else. | |
|