MITM vs promiscuous mode?

On a switched network, promiscuous mode does not show you any additional traffic because the network switch will only forward packets destined for your MAC address to your port on the switch. In the case of a MITM, you can use ARP spoofing or other MITM techniques to get clients to connect through you, such that you can see their traffic.

As you point out, a MITM can also conduct active attacks (tamper/modify/drop traffic) to further benefit their objectives.


There are many cases where MITM is better. For example, if Diffie-Hellman key exchange is involved, the encrypted traffic can still be accessed via MITM, but not by sniffing.