Excelet question. I would be most interested in how to detect these
devices. As I was alway under the impression a nic in promiscuous mode did
not transmit at all. Infact you could (an it has been known to happen) get
the nic a link and once the link is active, cut the transmit pair on the
cable and listen only on the recieve with out affecting anything on the
network.
At 09:45 AM 5/27/99 +0930, Ben Nagy wrote:
>Wow. What characteristic of the NIC allows you to detect this? I would have
>thought that it would be purely internal to the system running the NIC...Is
>there some weird Ethernet broadcast that the NIC sends when it's entering
>promiscuous mode?
>
>
>--
>Ben Nagy
>Network Consultant, CPM&S Group of Companies
>Direct Dial: (08) 8422 8319 Mobile: (0414) 411 520
> -----Original Message-----
>From: Mailing Lists [mailto:[EMAIL PROTECTED]]
>Sent: Wednesday, May 26, 1999 10:05 PM
>To: [EMAIL PROTECTED]
>Subject: Free Tools for detecting sniffers
>
>Hi!
>
>I'm looking for a free (or nearly free) tool in either Linux or NT that
>could tell me when a nic as been placed in promiscuous mode (aka, when a
>sniffer is started) on a machine. I want to run it in a cron job (or at
>job in NT) so that it could email or page me when it happens.
>
>Thanks!
>-
>[To unsubscribe, send mail to [EMAIL PROTECTED] with
>"unsubscribe firewalls" in the body of the message.]
>-
>[To unsubscribe, send mail to [EMAIL PROTECTED] with
>"unsubscribe firewalls" in the body of the message.]
>
-
[To unsubscribe, send mail to [EMAIL PROTECTED] with
"unsubscribe firewalls" in the body of the message.]
