Honeypots: RE: [inbox] undetectable NIC in promiscuous mode

[Chris Brenton <cbrenton () chrisbrenton org>]

On Fri, 2004-03-05 at 12:29, Curt Purdy wrote:
> Yes, there are protocols that do not depend on ip such as arp, dhcp, and
> others. 
Humm, I've never seen this myself. Please describe a situation I can try
and duplicate were an interface that does not have IP bound to it would
start transmitting ARP or DHCP packets.

> A sure way to avoid
> detection is to snip your TX lines 1&2.
This _does not_ work. I have tried this with both switches and hubs from
3COM, Cisco, D-Link & Netgear. Cutting the TX lines means you can not
initial the port to establish link. No link means you will not see
traffic.

HTH,
C