RE: Re: Detecting another sniffer

["McCammon, Keith" <Keith.McCammon () eadvancemed com>]

No, no, and no :)

By their nature, promiscuous interfaces do not send packets, and would not be detected by a system that relies on 
captured packets for analysis.

You could try something like Anti-Sniff (if it's still current), which is a promiscuous interface detection tool.  
Check it out at L0pht/AtStake.

Cheers

Keith

> -----Original Message-----
> From: Frank Edwards [mailto:pirgah () yahoo com]
> Sent: Friday, October 18, 2002 10:15 AM
> To: snort-users () lists sourceforge net
> Subject: [Snort-users] Re: Detecting another sniffer
>
>
> Does SNORT detects the existence of another sniffer on
> a internal network ?
>
> Let's say I'm running Ethereal on a internal network.
> Does SNORT will detect it ? Which kind of message will
> appear ?
>
> Thank you in advance
>
> __________________________________________________
> Do you Yahoo!?
> Faith Hill - Exclusive Performances, Videos & More
> http://faith.yahoo.com
>
>
> -------------------------------------------------------
> This sf.net email is sponsored by:ThinkGeek
> Welcome to geek heaven.
> http://thinkgeek.com/sf
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users