Re: detecting a sniffer remotely

[seregon () midsouth rr com (seregon)]

Bill Royds wrote:

> The L0pht AntiSniff program works by sending packets to all IP numbers and MAC
> addresses on a segment.  When a device is in
> promiscuous mode, the timing of ping replies and other packet messages will be
> different   than when it is not in this mode. By
> looking at time delays and other signatures, a probability of sniffing can be
> created for each IP. This is not guaranteed to work
> and won't work for all sniffers. But it will help to find anything attached to a
> IP enabled device which is more likely to be the
> intruder sniffing for passwords.

May not be all that helpful for systems where things like ping responses can be
assigned a priority (I think that Tandems allow this).

Regards,
seregon