This flag reports whether the interface is operating in promiscuous mode, accepting all packets/frames on the media (true) or only those addressed to this station (false). Admins check this to detect whether a NIC has been placed into a packet-capture mode, which can indicate an authorized diagnostic tool or an unauthorized sniffer; some agents also permit setting it to true, though that may require an interface reset to take effect. A value of true(1) on a production server NIC, when no capture session is expected, would prompt an admin to investigate for a rogue packet sniffer.