Re: detecting a sniffer remotely

[tschroed () acm org (Trevor Schroeder)]

On Thu, 14 Oct 1999, laurent van-cauwelaert wrote:

> What was the OS on the machine running the sniffer? 

NetBSD/pmax 1.4.1 on a DECstation 5000/25.

Haven't tried it with a faster box (which will have less pronounced
variance when the net is flooded)

> Does the sniffer resolv the address? (Because if it does
> it's really easy to detect)

Not by default (tcpdump -w foo.cap).
..........................................................................
: "I knew it was going to cost me my head and also my swivel chair, but  :
: I thought: What the hell--better men than I have risked their heads    :
: and their swivel chairs for truth and justice." -- James P. Cannon     :
:........... http://www.zweknu.org/ for PGP key and more ................: