Download PromiscDetect

PromiscDetect checks locally if your network adapter(s) is running in promiscuous mode, which may be a sign that you have a sniffer running on your computer. It was the first tool that could do that in Windows.

Usage instructions

Download the exe file and run it from the Command Prompt.

Questions and answers

Q: When I double-click on the file a window comes up and disappears immediately. What's wrong?

A: You must run the file from a Command Prompt.

Q: What would be the response for an adapter in "normal" mode?

A: It would be the filters Directed, Multicast and Broadcast.

Q: How reliable is this tool?

A: It's reliable as long as the attacker doesn't intercept and modify things somewhere between the tool and the adapter. Look at it this way: if the tool tells you that the adapter is in promiscuous mode it probably is - but if it doesn't you shouldn't just assume that the adapter isn't in promiscuous mode.

Q: My adapter is in promiscuous mode, but there's no sniffer on my computer. What's wrong?

A: For example, VMWare puts your adapter in promiscuous mode even if you're not running a sniffer.