Sebek detection

[<gconnell () middlebury edu>]

In the Know Your Enemy: Sebek whitepaper from honeynet.org, under the heading "Client Packet Export", it is made clear 
that "[Sebek] modifies the kernel such that the system is unable to see Sebek Packets, not just the packets generated 
by the local host, but any appropriatly configured Sebek Packet."

I'm sort of new at Sebek and haven't actually tested this idea out, but from the documentation, it seems there would be 
a pretty easy way to detect sebek running on a honeypot.  Why not just construct a sebek packet with some sort of 
packet generation tool (maybe nemesis?) and send it onto the network, then see if it can be seen by a regular tcpdump 
or snort session?

     --Cleverduck