�Hola!
> I have seen a program which can detect the machines running
> tcpdump or any other sniffer (to be exact, having an interface in the
> promiscuous mode). The program did this by sending a special packet for
> every machine on the local network. The packet was the normal ARP query
> except that it has some non-broadcast address instead of ff:ff:ff:ff:ff:ff
> in the destination HW address field. The Linux box in promiscuous mode
> can see this query and sends an ARP reply.
> Can the Linux ARP be modified to not replying to non-broadcast
> ARP packets?
Yes, but remember it isn't the only way to tell your box is in promisc mode.
> -Yenya
> --
> \ Jan "Yenya" Kasprzak <kas at fi.muni.cz> http://www.fi.muni.cz/~kas/
HoraPe
---
Horacio J. Pe�a
[EMAIL PROTECTED]
[EMAIL PROTECTED]
-
To unsubscribe from this list: send the line "unsubscribe linux-net" in
the body of a message to [EMAIL PROTECTED]
