Gee - lots of posts, but I want to make sure that I'm fully understanding your answer, d0pp. I understand that that mode will accept all packets, however in the scenario we're doing this with a switch or router, so even if it is in promiscuous, it won't receive those packets unless it is actively either legitimately receiving packets or intercepting, by receiving the packets intended for another machine and then forwarding to the true target. The reason obviously being because the information is not being broadcast to all ports. What I am questioning is if you can actively receive intercepted packets by ARP poisoning from multiple machines. Writing it out, from my limited understanding, it seems plausible, but initially I had hastily assumed you'd required multiple NICs. If that is the case, I apologize.

rasem