Sniffers that place network interface cards in promiscuous mode operate at which layer of the OSI model?

• A. Network
• B. Transport
• C. Physical
• D. Data Link

Answer: (C)

Promiscuous mode on a network interface card makes the NIC deliver every frame it sees on the local network segment to the software, not just frames addressed to it. The unit of data at this level is the frame, which is handled by the Data Link layer. So sniffing traffic by capturing all frames is a Data Link layer activity. The Physical layer deals with raw electrical signals and isn’t about selecting which frames to pass up. The Network and Transport layers deal with routing and delivering higher-level packets, not the raw frame capture performed by promiscuous mode. (Wireless sniffing in monitor mode follows the same Data Link perspective, just at the wireless medium.)