RE: [inbox] undetectable NIC in promiscuous mode

["Curt Purdy" <purdy () tecman com>]

Weaver, Woody wrote:
> In a *really strongly controlled* environment, a
> switch port that was live but was supposed to have no hosts attached
> would be a give-away. In a *paranoid* environment, the loss of carrier
> (while you attached a hub to the live port) without
> explanation would be
> a give-away.

Jeese, I found someone more paranoid than me ;)  Actually I was thinking in
relation to an IDS being detected by an attacker.  This is the mode I run
Snort on to prevent that.

Curt Purdy CISSP, GSEC, MCSE+I, CNE, CCDA
Information Security Engineer
DP Solutions

----------------------------------------

If you spend more on coffee than on IT security, you will be hacked.
What's more, you deserve to be hacked.
-- White House cybersecurity adviser Richard Clarke