Honeypots mailing list archives

RE: [inbox] undetectable NIC in promiscuous mode


From: Chris Brenton <cbrenton () chrisbrenton org>
Date: Fri, 05 Mar 2004 20:37:54 -0500

On Fri, 2004-03-05 at 16:25, Bement, Daniel wrote:
There have been situations (depending on the hardware) I have seen where if one of the wires in the TX pair is cut or 
(not making good connection) it will still maintain link with the switch while not allowing any data to pass through 
to the switch..

Sounds like you made an accidental choke circuit. ;-)

I've actually built boxes to do exactly what you describe. Basically you
tune the TX circuit to shunt 10 MHz to ground for 10 Mb, and 100 MHz for
100 Mb. This permits DC to pass, allowing link to be established, but
chokes out any Ethernet transmissions.

C




Current thread: