GO to the azbil Global Site

The photo of a boy and his father who are looking at the screen of pc. Products Company Research In The Media Contact




Renowned network sniffing detection software

PromiScan is a renowned sniffing node detection tool and has been used worldwide ever since its release. Promiscan is one of the tools mentioned in the 2003 SANS/FBI Top 20.

PromiScan 3.0 (commercial version) has improved its monitoring capabilities by providing continuous monitoring to detect promiscuous applications starting and ending without increasing the network load.

Today, many examples of information leaks from corporations can be seen in recent headlines and potential network sniffing by malicious insiders could represent a significant threat to many corporations. Network sniffing enables listeners to listen in on all network communications and to obtain passwords to gain unauthorized access to a server, which could result in divulging mission-critical corporate data. Still, no effective measures to prevent network sniffing have been implemented to date. By simply activating sniffing software, an individual with malicious intent can passively accept all packets, regardless of their destination addresses, without sending any suspicious packets. For this reason, it's extremely difficult to detect sniffers.

PromiScan 3.0 is an innovative application software for remotely monitoring computers on local networks to locate network interfaces operating in a promiscuous mode that illegally accepts all packets. PromiScan 3.0 continuously monitors traffic to detect sniffing programs starting and ending and alert the administrator. By installing PromiScan 3.0, you can detect network sniffing immediately and can even prevent potential sniffing activities by people inside your intranet.

Cyclic scanning

In the Cyclic Scan mode, you can perform cyclic scanning to monitor network interface state changes. In this mode, network interface state changes caused by starting or ending a network analyzer such as Ethereal can be detected to obtain more reliable detection results.

Slow scanning supported

Scanning speed can be selected. Making it higher allows you to scan your network without adding any additional network load.


In the Cyclic Scan mode, network interface state changes can be browsed and written into a log file. This log file can be viewed by the other systems.

Node Viewer

Network interface state changes of specified computers can be displayed in chronological order for monitoring.

Warning Window

When you are in the Cyclic Scan mode, if a network interface state change caused by starting and ending a promiscuous application is detected, a warning window pops up.

Logging with SYSLOG

If you use SYSLOG for logging data, PromiScan installed in two or more segments can be monitored at a central location with commercial SYSLOG monitor software, thus enabling centralized network monitoring.

Operating Environment

PromiScan 3.0 requires the following operating environment.


Windows 2000 or Windows XP


Depends on OS (not specified in particular)


Ethernet interface card (NIC)


WinPcap 3.0 or higher


Administrator privilege


Installation and Startup

  1. Installing WinPcap 3.0
    Download and execute the WinPcap 3.0 auto-installer and it is completely installed.
  2. Installing PromiScan
    Decompress PromiScan and run Setup.exe to install PromiScan.
  3. Copying oui.txt
    Copy oui.txt to the folder where PromiScan is installed.
  4. Starting PromiScan and setting the license information
    Run promiscan.exe and the PromiScan License Registration window appears.

License Registration

For license registration, fill in these three fields properly and click the Registration button.


Values To Be Specified

IP Address field
(in the Network Information pane)

IP address on the network you use.  The least significant bit of the Class C network address (IP address) is automatically set to 0, allowing you to run PromiScan on IP addresses 0 - 255 among the network addresses.  Once registered, the IP addresses cannot be changed.

Product Code field

Product code provided by our company.

License Key field

License key provided by our company.

Once your license registration is completed, this PromiScan main window appears.


To uninstall PromiScan Version 3.0, click on the Windows Start button, open the Control Panel, and double-click on Add or Remove Programs.   In the Add or Remove Programs window, select Azbil SecurityFriday PromiScan and click Change/Remove.  The program is uninstalled (removed).

If you remove the program or its folder directly, you may be unable to reinstall the program.  Be sure to uninstall the program.

Technical Documents


PromiScan  Non-commercial version (0.29)


Download here




(C)Azbil SecurityFriday Co., Ltd. All rights reserved.