Nic working modes

Program implementation is required to change the network adapter's working mode. software such as Sniffer generally uses the network adapter to set the network adapter to the hybrid mode to obtain data packets. After the network adapter is set to the hybrid mode, because the NIC receives all the data that can be received, the data volume is very large at this time. Therefore, when you set this mode to hybrid mode, you must set filtering conditions. Software such as sniffer sets the NIC to the hybrid mode, and only allows you to monitor data (automatically set filtering conditions according to user requirements ), after the software exits, it automatically restores the NIC to the normal working mode. The following is a detailed description of the NIC mode. Ethernet has the characteristics of shared media. Information is transmitted in plain text on the network. When the network adapter is set to the listening mode (mixed mode, promiscuous), due to the use of Ethernet broadcast channel contention, the listening system and the normal communication network can be connected in parallel, and can capture any data packet transmitted in the same conflict domain. The IEEE 802.3 standard Ethernet adopts the continuous CSMA mode. It is precisely because Ethernet adopts this broadcast channel contention mode that each site can obtain data sent from other sites. Using this principle, the information capture system can intercept the information we need, which is the physical basis for capturing data packets. Ethernet is a bus-type network, logically, it is composed of one bus and multiple sites connected to the bus. Each site uses the CSMA/CD protocol mentioned above for channel contention and sharing. Each site (specifically the interface card used by the computer) Nic to implement this function. The main task of the network adapter is to test the current status of the bus, determine whether to transfer data, and determine whether the destination of each physical data frame is the address of this site. If not, it indicates that it is not sent to the site but discarded. If yes, The system receives the data frame, checks the CRC of the physical data frame, and submits the data frame to the LLC sublayer. Nic has the following working modes: 1) broadcast mode (Broad Cast Model): its physical address (MAC) address is 0 Xffffff frames are broadcast frames, the network adapter that works in broadcast mode receives broadcast frames. 2) MultiCast transmission (MultiCast Model): frames of the MultiCast Transmission address as the destination physical address can be received by other hosts in the group at the same time, but cannot be received by hosts outside the group. However, if you set the network adapter to multicast transmission mode, it can receive all multicast transmission frames, regardless of whether it is a member of the group. 3) Direct Model: in Direct mode, the network adapter only receives frames whose target address is its own Mac address. 4) Promiscuous Model: The network adapter that works in the hybrid mode receives all frames flowing through the network adapter. The packet capture program runs in this mode. The default working mode of the network adapter includes the broadcast mode and direct mode, that is, it only receives broadcast frames and sends them to its own frames. If the hybrid mode is used, the network card of a site will accept the packets sent by all sites in the same network so that the network information can be monitored and captured.