Providing access to the datalink layer for an application is a powerful feature that is available with most current operating systems. This provides the following capabilities:
The ability to watch the packets received by the datalink layer, allowing programs such as
tcpdump to be run on normal computer systems (as opposed to dedicated hardware devices to watch packets). When combined with the capability of the network interface to go into a promiscuous mode, this allows an application to watch all the packets on the local cable, not just the packets destined for the host on which the program is running.
This ability is less useful in switched networks, which have become quite common. This is because the switch ...