Wireshark · Ethereal-dev: Re: [Ethereal-dev] question about the promisc mode in the ethereal, is it a bug?

[Guy Harris <gharris@xxxxxxxxx>]

On Sat, Aug 07, 2004 at 10:23:24AM +0800, Li Haijiang wrote:
> Now I found the mode of network card become promisc after I start to
> capture in the ethereal,and the mode is still promisc after finishing
> the capture.

What operating system are you using?  That *shouldn't* be happening,
unless some *other* program is also doing a promiscuous-mode capture on
the same network card.  (I assume that "after finishing the capture"
means that you've terminated Tethereal with ^C or stopped the capture in
ethereal.)

> So I think it is the reason that lead to my pc server down in the giga
> ethernet.So I think it should be set the mode unpromisc that can reduce
> more  usage of the memeory of the server.

Promiscuous mode could use some more memory for packet buffers, as the
network card will supply more packets to the CPU (it will supply even
unicast packets not sent to the machine, *if* it sees them - it probably
*won't* see them on a switched network, however).  However, the resource
it's most likely to consume a lot of is CPU time, not memory.