Bugtraq: Re: packet logs

[crow!rik () uunet UU NET (Rik Farrow)]

I have been playing with netstat, trying to see if it can detect something
unusual when a process is listening promiscously.  There is nothing I could
see.  However, when you use ifconfig, you WILL see the PROMISC flag:

crow% ifconfig le0
le0: flags=163<UP,BROADCAST,NOTRAILERS,RUNNING,PROMISC>
        inet 192.26.58.254 netmask ffffff00 broadcast 192.26.58.0
crow% []

So there is a way to see if someone (at least on Suns where the attacks have
been occurring) has a listening daemon set up.

rik () uworld com