RE: How can I detect if there is a sniffer running on my local sobnet?

[Oliver Enzmann]

> <Snip>
> >> CB> a network address or a MAC address meaning that it can be
> >> CB> completely invisible from OSI layers 2 and up.
> >> 
> >> The classic trick is to cut the TX wire. That makes it rather 
> >> hard to detect the sniffer.

It's sufficient to leave an interface unconfigured without 
an IP address on most Unix boxes. No IP address, no ARP replies 
and therefore no way to detect your MAC address. You will still 
be able to snoop on the wire as promiscuous mode works independent
of IP addresses being configured on the interface or not.

--Oliver

-
[To unsubscribe, send mail to [EMAIL PROTECTED] with
"unsubscribe firewalls" in the body of the message.]