How Packet Capture Works

A network interface card normally discards packets not addressed to its MAC address. Promiscuous mode disables this filter, causing the NIC to pass all frames it receives to the operating system regardless of destination. With administrator privileges, any application can put the interface into promiscuous mode and receive all traffic visible on the network segment, not just traffic addressed to that machine.

libpcap is a portable C library that provides a standard API for packet capture on Unix-like systems. WinPcap and its successor Npcap provide the equivalent on Windows. Virtually every packet capture and network analysis tool, including Wireshark, tcpdump, and Snort, uses libpcap as the underlying capture engine. It handles the low-level interaction with the operating system and exposes a filter language for selecting specific packets.