Honeypots mailing list archives

Re: undetectable NIC in promiscuous mode


From: Chris Brenton <cbrenton () chrisbrenton org>
Date: Fri, 05 Mar 2004 11:39:29 -0500

On Fri, 2004-03-05 at 04:40, Jose_Maria_Gonzalez () dell com wrote:
Hi There,
 
Correct me if I am wrong but would a host with a NIC in promiscuous mode with no IP set-up be detectable?

If it was plugged into a switch port, *and* you monitor the switch
stats, you would see the system receiving data but never transmitting. 

Beyond that, your hosed. ;-)
C




Current thread: