Exam 312-49v10 topic 1 question 267 discussion

D. Data Link https://www.sciencedirect.com/topics/computer-science/promiscuous-mode

Sniffers that place NICs in promiscuous mode are designed to capture all network traffic, including packets not addressed to the NIC's MAC address. This is accomplished by allowing the NIC to capture all packets on the network segment, regardless of whether they are intended for the NIC's host system. Since this involves capturing and analyzing the data link layer packets, such sniffers work at the Data Link layer of the OSI model.

Network Cards are on the Data Link layer. D is the only answer.

A NIC covers layers 1 and 2. Promiscuous mode is when the NIC ignores the destination MAC address [ Layer 2 ] If ignored then is not using any upper layer so it is in layer 1.

Sniffers that place Network Interface Cards (NICs) in promiscuous mode operate at the data link layer, which is Layer 2 of the OSI (Open Systems Interconnection) model. The data link layer is responsible for the transmission and reception of data frames within a local network. When a NIC is in promiscuous mode, it captures and processes all data frames on the network segment to which it is connected, regardless of whether the frames are intended for that specific NIC or not. This mode allows the sniffer to intercept and analyze network traffic, including Ethernet frames, without being restricted to only capturing the frames specifically addressed to its own MAC (Media Access Control) address. Promiscuous mode is often used in network monitoring and packet analysis tools, such as network analyzers and protocol analyzers, to capture and inspect network traffic for troubleshooting, security, and analysis purposes. It enables the collection of data at a lower network layer, which can be useful for diagnosing network issues, monitoring security, and examining network behavior. --> Data link

D: A NIC covers layers 1 and 2. Promiscuous mode is when the NIC ignores the destination MAC address which is part of layer 2.

D. data link layer

Only the physical NIC card can be considered layer 1. Once any protocols are put on it or a non physical tool is used to sniff, it would have to be layer 2 (data-link), right?