Re: Counter detect Network Sniffer

["M. Dodge Mumford" <dodge () nfr net>]

Bill Mok said:
> Is there any method to detect one using sniffer, say
> ethereal, in the same network?

The most notable attempt I'm aware of was the l0pht's AntiSniff. It used a
variety of methods, which included:

- ping all the hosts on a local subnet, to get an idea of the average
  response times. Flood the network with garbage traffic, then ping again.
  Hosts whose response times varied were probably sniffing (due to increased
  cpu load)

- Send packets from bizarre network addresses, and look for DNS PTR
  requests. 

- Attempt to exploit various kernel-layer issues (especially notable was a
  mistake in linux 2.0.x kernel where it would pass packets given certain
  mac/ip combinations)


-- 

Dodge

Attachment: _bin
Description: