Bugtraq: Re: snooper watchers

[aleph1 () dfw net (Aleph One)]

Here are a few I found:

        http://underground.org/tools/unix/audit/cpm/cpm.1.0.tgz
        http://underground.org/tools/unix/audit/ifstatus/ifstatus.tgz

Dont know if they will work on Solaris 2.x though.


On Wed, 22 Feb 1995, Eric Conrad wrote:

> The first thing many crackers do is replace ifconfig with a trojan that 
> won't report when an interface is in promiscuous mode.
>
> You could look at 'cpm', which will also show when an interface is 
> promiscuous.  It's available from ftp.cert.org.  You're still in the same 
> boat if someone replaces it with their own, however.
>
>                               ...Eric