Honeypots: RE: [inbox] undetectable NIC in promiscuous mode

["Curt Purdy" <purdy () tecman com>]

Jose_Maria_Gonzalez wrote:

> Correct me if I am wrong but would a host with a NIC in 
> promiscuous mode with no IP set-up be detectable?
Yes, there are protocols that do not depend on ip such as arp, dhcp, and
others.  Of course nothing in layer 2 depends on ip.  A sure way to avoid
detection is to snip your TX lines 1&2.

Curt Purdy CISSP, GSEC, MCSE+I, CNE, CCDA
Information Security Engineer
DP Solutions

----------------------------------------

If you spend more on coffee than on IT security, you will be hacked. 
What's more, you deserve to be hacked.
-- White House cybersecurity adviser Richard Clarke

<<attachment: winmail.dat>>