How to find out that a NIC is in promiscuous mode on a LAN? DNS
test - many packet sniffing tools perform IP address to name
lookups to provide DNS names in place of IP addresses. To test
this, you must place your network card into promiscuous mode and
sends packets out onto the network aimed to bogus hosts. If any
name lookups from the bogus hosts are seen, a sniffer might be
in action on the host performing the lookups. ARP Test - When in
promiscuous mode the driver for the network card checks for the
MAC address being that of the network card for unicast packets,
but only checks the first octet of the MAC address against the
value 0xff to determine if the packet is broadcast or not. Note
that the address for a broadcast packet is ff:ff:ff:ff:ff:ff. To
test for this flaw, if you send a packet with a MAC address of
ff:00:00:00:00:00 and the correct destination IP address of the
host. After receiving a packet, the Microsoft OS using the
flawed driver will respond while in promiscuous mode. Probably
it happens