Re: Counter detect Network Sniffer

["M. Dodge Mumford" <dodge () nfr net>]

Aditya, ALD [Aditya Lalit Deshmukh] said:
> M. Dodge Mumford
> > - Send packets from bizarre network addresses, and look for DNS PTR
> >   requests. 
>
> how does this work ? guess i will have to look & search with google ... 

Pretty simply, really. If you run tcpdump without the -n option, it attempts
to resolve IP addresses into domain names. If you inject traffic from (say)
127.1.2.3 (or any other address you should _never_ see on a live network),
and then if you see a DNS PTR request for it, you know the host that sent
the PTR is sniffing traffic.

-- 

Dodge

Attachment: _bin
Description: