How to detect promiscuous mode of network interface in C#?

Question

0.00/5 (No votes)

See more:

I am building an application to detect whether the network interface is in promiscuous mode or not.
We can detect it by sending a ping (ICMP echo request) with the wrong MAC address but the right IP address. If an adapter is operating in normal mode, it will drop this frame, and the IP stack never sees or responds to it. If the adapter is in promiscuous mode, the frame will be passed on, and the IP stack on the machine (to which a MAC address has no meaning) will respond as it would to any other ping.
But I don't know how to implement it in c#.

What I have tried:

I have tried this code but it gives me mac address for any particular ip address.

if (SendArp(ip, 0, macAddr, ref macAddrLen) != 0)
{
    return false;
}
else
{
   }

Posted 19-Feb-17 0:00am

NoorKaximi

Updated 19-Feb-17 4:34am

v3

Add a Solution

2 solutions

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Graeme_Grant · Answer 1 · 2017-02-19T04:34:00

Solution 2

From StackOverflow[^]

Quote:

Use System.Management for such kind of queries. MSFT_NetAdapter class, PromiscuousMode property. Use WMI Code Creator to experiment and arrive at the correct C# code. – Hans Passant

Posted 19-Feb-17 4:34am

Graeme_Grant

Comments

NoorKaximi 19-Feb-17 15:47pm

try
{
ManagementObjectSearcher searcher =
new ManagementObjectSearcher("root\\StandardCimv2",
"SELECT * FROM MSFT_NetAdapter");

foreach (ManagementObject queryObj in searcher.Get())
{
Console.WriteLine("-----------------------------------");
Console.WriteLine("Name: {0}", queryObj["Name"]);

Console.WriteLine("PromiscuousMode: {0}", queryObj["PromiscuousMode"]);

}
}
catch (ManagementException e)
{
MessageBox.Show("An error occurred while querying for WMI data: " + e.Message);
}
I tried the above code but it is not working it return promiscuous mode false although i have enabled it using wireshark. Wireshark show promiscuous mode is enabled but wmi query return false for promiscuous mode

RickZeeland · Answer 2 · 2017-02-19T00:19:00

Solution 1

You can use WMI to get the MAC adress(es), see this post:
C# Get Computer's MAC address "OFFLINE" - Stack Overflow[^]

Posted 19-Feb-17 0:19am

RickZeeland

Comments

NoorKaximi 19-Feb-17 6:31am

i don't need MAC Address
I want to detect the promiscuous mode of network interface. Kindly read complete question.

Ralf Meier 19-Feb-17 6:39am

What do you mean with "promiscuous mode" ?
There are a lot of possible translations for this word with different sense ...

NoorKaximi 19-Feb-17 6:41am

In computer networking, promiscuous mode (often shortened to "promisc mode" or "promisc. mode") is a mode for a wired network interface controller (NIC) or wireless network interface controller (WNIC) that causes the controller to pass all traffic it receives to the central processing unit (CPU) rather than passing only the frames that the controller is intended to receive.

Ralf Meier 19-Feb-17 6:46am

OK ... I understand ...
What I suggest would be :
create a Timer with a cyclic Method-call or a BackgroundWorker or a Thread.
In this method you check this interface and give the result back with for example a public Variable.

NoorKaximi 19-Feb-17 6:48am

i just want to check whether promiscuous mode is enabled or not on my PC.

NoorKaximi 19-Feb-17 6:48am

Kindly provide me complete code...

Ralf Meier 19-Feb-17 6:52am

I can't help you with the code for this - but I think you still have it.
But I can help you to change this code into a cyclic working one ...

NoorKaximi 19-Feb-17 6:55am

i don't think making it cyclic will work...

Ralf Meier 19-Feb-17 7:00am

Before you updated your question you had a complete different code.
What was the matter with this code ?

NoorKaximi 19-Feb-17 7:04am

I have deleted extra codes.
It is the main function through which i am trying to achieve my goal.