Nmap Hackers: Re: Promiscuous mode detection

[Joel Eriksson <na98jen () student hig se>]

On Thu, 4 Mar 1999, Bennett Todd wrote:

> The code posted reports whether the machine is it run on has its interface in
> promisc mode; so does "ifconfig -a|grep PROMISC".
It should be noted that ifconfig is often patched by hackers, ioctl()
could of course also be patched, by a kernel-module for example, but it is
not as common. It is only for local interfaces of course. Neped, that I
wrote about in my previous posting may be used to detect Linux-boxes with
network interfaces in promiscuous mode, using ARP. But there are of course
no universal way of detecting sniffers on the network.

> -Bennett
/ Joel Eriksson