How to Set a Network Interface to Promiscuous Mode Permanently on Linux

Updated: 28 September 2026 · Applies to: NetworkManager 1.54 and 1.56 on AlmaLinux and Rocky Linux 9 and 10 and RHEL 9 and 10; iproute2 on Ubuntu 24.04 and 26.04 and Debian 13

A network interface in promiscuous mode passes every packet it sees to the system, not only packets addressed to it. Packet capture and intrusion detection tools (tcpdump, Wireshark, Suricata, Zeek) and some bridge or virtual machine setups need it. The CentOS 7 method of adding PROMISC=yes to ifcfg files no longer applies: RHEL 9 and 10 use NetworkManager keyfiles.

Promiscuous mode can only show traffic that actually reaches the interface. On a switched network or a VPS, that is mostly traffic for this server plus broadcasts.

Check the current state

ip link show eth0

If the flags in angle brackets include PROMISC, the mode is on. Replace eth0 with your interface name from ip link.

Switch it on until the next reboot (all distributions)

ip link set dev eth0 promisc on
ip link set dev eth0 promisc off     # switch it off again

Make it permanent on AlmaLinux, Rocky Linux and RHEL

1. Find the connection that belongs to the interface: nmcli -f NAME,DEVICE connection show
2. Set the option on that connection and re-activate it:

   nmcli connection modify "eth0" 802-3-ethernet.accept-all-mac-addresses yes
   nmcli connection up "eth0"

   Re-activating briefly interrupts the network on that interface, so do it from a console, or be ready to reconnect.
3. Check with ip link show eth0: the flags now include PROMISC, also after a reboot.

Make it permanent on Ubuntu and Debian

Netplan has no option for promiscuous mode, so use a small systemd service that switches it on after the network starts:

1. Create /etc/systemd/system/promisc@.service:

   [Unit]
   Description=Promiscuous mode on %i
   After=network-online.target
   Wants=network-online.target
   
   [Service]
   Type=oneshot
   ExecStart=/usr/sbin/ip link set dev %i promisc on
   RemainAfterExit=yes
   
   [Install]
   WantedBy=multi-user.target

2. Enable it for your interface:

   systemctl daemon-reload
   systemctl enable --now promisc@eth0.service

This service works on AlmaLinux, Rocky Linux and RHEL too, if you prefer one method everywhere.

Common problems

• "device eth0 entered promiscuous mode" filling the logs: the kernel logs every change. See how to stop repeated promiscuous mode messages.
• A capture shows no other traffic: switches only send a port the traffic meant for it. Capturing a whole network needs a mirror (SPAN) port on the switch.

Official documentation: NetworkManager 802-3-ethernet settings and ip-link manual page.