Re: RE: detecting a sniffer remotely

[mlists () gizmo kyrnet kg (CyberPsychotic)]

~ 
~ I grabbed the L0pht's AntiSniff for UNIX and it worked reasonably well.  Of
~ course, that was against a slow box, so the PING variance test worked like
~ a charm.
~ 

well, L0pht's AntiSniff won't work on switched networks, since switches
memorize mac addresses of the devices connected to each ports and would
drop maliformed frames. But neither sniffing would work in such
envinroment. (just to make sure you haven't missed this detail ;-))