I have question about promiscuous mode.in a lan nework if one of the node is having a lan card set in ...?

Question

...promiscuous mode then it starts sniffing all the data packets flowing across the lan this can b harmful.in a lan nework if one of the node is having a lan card set in promiscuous mode then it starts sniffing all the data packets flowing acrossthe lan.we will send arp packets in lan with a destination address of which no node exist in the lan.in promiscuous mode the node wil accept those packets & wil respond toit.in promiscuous mode all the packets in lan are accepted irrespective of their destination address.as soon as a node wil respond we can get 2 know that an NIC is in promiscuous mode or not.there are 2 type of filtering done here:
hardware filtering & software filtering.
in hardware filtering the destination address of packets are atched wid hardware address.& hence on this basis filtering is done.but in promiscuous mode hardware filtering is not done at all..........so software filtering is done.in this the kernel wil have 2 decide how these arp packets wil b handled.

diiferent o.s wil handle them differently & in linux due to the open
source code of the kernel its easier to understand but the main problem
wil come when working with windows.

Answer 1

no, it's not a problem. the reason is that although the h/w is accepting all frames, when the lower level hands the packet up to a higher level the higher level recognizes that the packet is not for it and doesn't respond.

so you used arp as an example - not a good example because the frame is a broadcast frame so it will be accepted by the device even if it's not in promiscuous mode. but when the packet is passed to the higher layer for inspection (in this case IP), that layer will see that the ip address being resolved is not it's own and will not respond. same thing with any other packets that get accepted - if they are not for that node then they will simply get dropped by the higher level protocol.

Answer 2

You have not clearly specified what the question is.

If a node is in promiscous mode and the software driver is written to just look at all the packets and not to respond to any of the probing packets, there is no way to find if a sniffing node is there.