How to Enable and Disable Promiscuous Mode in Linux Using ip link

By default, a Linux network interface controller (NIC) operates in normal filtering mode: the hardware frame filter inspects incoming Ethernet frames and discards any frame whose destination MAC address does not match the interface’s own hardware address, a multicast group it has joined, or the broadcast address (ff:ff:ff:ff:ff:ff). While this selective filtering reduces CPU overhead and bus traffic, network analysis tools, software bridges, virtual switches, and Intrusion Detection Systems (IDS) require full packet visibility. Enabling promiscuous mode instructs the NIC to pass all incoming Ethernet traffic directly to the operating system kernel for inspection.

What Is Promiscuous Mode and When Is It Used?

Promiscuous mode (frequently abbreviated as PROMISC) disables the network card’s hardware MAC filter. As a result, the kernel network stack receives every frame travelling across the local physical segment or virtual switch port, regardless of intended recipient.

Standard use cases for enabling promiscuous mode include:

• Packet Sniffing and Deep Packet Inspection: Running diagnostic utilities such as tcpdump, Wireshark, or Zeek to capture raw network traces across shared hubs, mirrored switch ports (SPAN), or virtual taps.
• Software Bridging and Hypervisors: Virtualisation platforms like KVM, QEMU, and LXC rely on bridging where the host interface must receive frames bound for guest virtual machines with different MAC addresses. You can learn how to create and configure network bridges in Linux using ip link to interconnect physical interfaces with virtual machines.
• Intrusion Detection and Network Forensics: Security appliances such as Snort and Suricata monitor mirrored uplinks in promiscuous mode to detect malicious payloads, port sweeps, and abnormal protocol handshakes. Power users also frequently discover local network devices in Linux using arp-scan when auditing subnets.

Checking Current Interface Promiscuous Status

Modern Linux distributions utilise the iproute2 suite rather than the deprecated ifconfig utility. You can inspect interface flags using the ip link command.

Open your terminal and run:

ip link show eth0

Replace eth0 with your target interface name (such as enp3s0 or wlan0). If you do not know the exact interface identifier, run ip -br link to view a concise table of all registered network devices.

Examine the flag list contained within angle brackets <...> on the first output line:

2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000
    link/ether 00:1a:2b:3c:4d:5e brd ff:ff:ff:ff:ff:ff

If the word PROMISC is absent from the flag list, promiscuous mode is currently disabled.

How to Enable Promiscuous Mode Using ip link

Modifying kernel-level network device flags requires root privileges via sudo.

1. To turn on promiscuous mode for an interface, execute:

   sudo ip link set dev eth0 promisc on

2. Verify that the flag has been applied by querying the interface status again:

   ip link show eth0

3. Review the flags inside the angle brackets. You will now observe the PROMISC flag prominently listed:

   2: eth0: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000
       link/ether 00:1a:2b:3c:4d:5e brd ff:ff:ff:ff:ff:ff

4. Confirm kernel acknowledgement by inspecting the kernel ring buffer using dmesg:

   sudo dmesg | grep -i promisc

   The kernel prints a log entry indicating that the interface entered promiscuous mode:

   [ 1245.678901] device eth0 entered promiscuous mode

How to Disable Promiscuous Mode Using ip link

Leaving promiscuous mode enabled unnecessarily introduces performance overhead and potential privacy risks, as the kernel must allocate memory and processor cycles to evaluate every frame on the wire. When your capture session or testing is finished, return the NIC to standard filtering mode.

1. Run the following command to disable promiscuous mode:

   sudo ip link set dev eth0 promisc off

2. Verify that the PROMISC flag has been removed:

   ip link show eth0

   The angle brackets should once again display only standard flags (e.g., <BROADCAST,MULTICAST,UP,LOWER_UP>).
3. Check the kernel log to confirm that the device successfully exited promiscuous operation:

   sudo dmesg | tail -n 5

   You will see:

   [ 1390.112233] device eth0 left promiscuous mode

Persisting Promiscuous Configuration Across Reboots

Commands issued via ip link set interact directly with the active runtime kernel state and reset automatically upon reboot. If your server hosts virtual machine hypervisors or dedicated IDS monitoring daemons that require permanent promiscuous operation, configure your network manager accordingly.

Configuring Promiscuous Mode in systemd-networkd

In modern server distributions managed by systemd-networkd, open or create a configuration override file under /etc/systemd/network/ (for example, /etc/systemd/network/10-eth0.network):

[Match]
Name=eth0

[Network]
DHCP=yes
Promiscuous=yes

Restart the network daemon using sudo systemctl restart systemd-networkd to apply the persistent setting.

Configuring Promiscuous Mode in Netplan (Ubuntu / Debian)

For systems using Netplan with the networkd renderer, add an activation-mode directive inside /etc/netplan/01-netcfg.yaml:

network:
  version: 2
  renderer: networkd
  ethernets:
    eth0:
      dhcp4: true
      activation-mode: off
      # Alternatively configure promiscuous behavior via systemd network drop-ins

For broader network interface tuning, you can also explore how to change network interface MTU in Linux using ip link or how to change network interface transmit queue length in Linux to handle intense packet capture throughput without dropping frames.