RE: Re: [tool] the new p0f 2.0.1 is now out

[Michal Zalewski <lcamtuf () ghettot org>]

On Thu, 4 Sep 2003, Parker, Jeff (MSE) wrote:

> Regarding detecting a machine with p0f installed/running, you may have
> better success simply trying to detect for any network adapter in
> promiscuous mode.  And there's tons of info available on that...

Yup, but p0f does not default to promisc mode anymore (for performance
reasons and so on).

-- 
------------------------- bash$ :(){ :|:&};: --
 Michal Zalewski * [http://lcamtuf.coredump.cx]
    Did you know that clones never use mirrors?
--------------------------- 2003-09-04 22:01 --

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html