Re: detecting a sniffer remotely

[Laurent.Van-Cauwelaert () epita fr (laurent van-cauwelaert)]

> I grabbed the L0pht's AntiSniff for UNIX and it worked reasonably well.  Of
> course, that was against a slow box, so the PING variance test worked like
> a charm.

What was the OS on the machine running the sniffer? 
     -Latest version of linux kernel seems to have a good implementation
     of TCP/IP, I mean the kernel only response to what he should, for
     example:
         a forged packet with the ip_addr of the machine running the
         sniffer but without the correct mac_addr, won't have any response)

Does the sniffer resolv the address? (Because if it does
it's really easy to detect)

van-ca_l () epita fr