nanog mailing list archives
RE: sniffer/promisc detector
From: "Wojtek Zlobicki" <wojtekz () idirect com>
Date: Fri, 16 Jan 2004 18:01:35 -0500
Since all sniffers I know of are passive devices, there really shouldn't be a way to track one down. From a Cisco standpoint, if I were mirroring a port, and had a sniffer mirroring the sniffer port, I would see traffic of a unicast nature with multiple unicast MAC destinations destined at a swithport with only one MAC address cached. -----Original Message----- From: owner-nanog () merit edu [mailto:owner-nanog () merit edu] On Behalf Of Gerald Sent: Friday, January 16, 2004 5:35 PM To: nanog () merit edu Subject: sniffer/promisc detector Subject says it all. Someone asked the other day here for sniffers. Any progress or suggestions for programs that detect cards in promisc mode or sniffing traffic? Gerald
Current thread:
- Re: sniffer/promisc detector, (continued)
- Re: sniffer/promisc detector Donovan Hill (Jan 17)
- Re: sniffer/promisc detector Valdis . Kletnieks (Jan 17)
- Re: sniffer/promisc detector Donovan Hill (Jan 17)
- Re: sniffer/promisc detector Deepak Jain (Jan 17)
- Re: sniffer/promisc detector E.B. Dreger (Jan 18)
- Re: sniffer/promisc detector Gerald (Jan 19)
- Re: sniffer/promisc detector Scott McGrath (Jan 19)
- Re: sniffer/promisc detector Gerald (Jan 19)
- Re: sniffer/promisc detector Chris Brenton (Jan 16)
- Re: sniffer/promisc detector Alexei Roudnev (Jan 17)
- Re: sniffer/promisc detector haesu (Jan 17)
- Re: sniffer/promisc detector Valdis . Kletnieks (Jan 17)
- Re: sniffer/promisc detector Alexei Roudnev (Jan 17)
- Re: sniffer/promisc detector Vadim Antonov (Jan 19)
- Re: sniffer/promisc detector Paul Vixie (Jan 19)
- Re: sniffer/promisc detector Alexei Roudnev (Jan 19)
- Re: sniffer/promisc detector Brett Watson (Jan 19)
- Re: sniffer/promisc detector Valdis . Kletnieks (Jan 19)