Re: RE: detecting a sniffer remotely

[mlists () gizmo kyrnet kg (CyberPsychotic)]

~ 
~ Does anyone knows if it's possible to detect remotely a sniffing host
~ (specially whithout knowing its IP or MAC address.
~ 

Most sniffer detectors based on bug(?) in IP stack implementation, which
makes host, which device(s) is running in promisc. mode recognize IP
packet, even if the mac address in ethernet frame doesn't match.
(otherwise such ethernet frame would get dropped earlier). 

if the box running sniffer has IP stack running, you could probably
detect it's ip address by generating various broadcasts, and listening to
what stuff has been transmitted over the wire. Once the IP address has
been learnt, you could deploy the scheme above..