Re: RE: detecting a sniffer remotely

[Laurent.Van-Cauwelaert () epita fr (laurent van-cauwelaert)]

> Most sniffer detectors based on bug(?) in IP stack implementation, which
> makes host, which device(s) is running in promisc. mode recognize IP
> packet, even if the mac address in ethernet frame doesn't match.
> (otherwise such ethernet frame would get dropped earlier). 

After few test:
It seems that NetBSD 1.4.1 is affected by this "bug".
Linux slackware 4 isn't.