You can detect when M$'s network monitor/agent is active by looking in the
WINS database (you can dump the WINS db with winsdmp.exe from the reskit).
Look for:
MachineName++++++++++ (they look like upsidedown F's in a cmd.exe window)
Ben.
____________________________________________
Ben Conrad
GTE Internetworking, Server Administration
[EMAIL PROTECTED]
781-262-5146
____________________________________________
> -----Original Message-----
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED]]On Behalf Of Mailing Lists
> Sent: Wednesday, May 26, 1999 8:35 AM
> To: [EMAIL PROTECTED]
> Subject: Free Tools for detecting sniffers
>
>
> Hi!
>
> I'm looking for a free (or nearly free) tool in either Linux or NT that
> could tell me when a nic as been placed in promiscuous mode (aka, when a
> sniffer is started) on a machine. I want to run it in a cron job (or at
> job in NT) so that it could email or page me when it happens.
>
> Thanks!
> -
> [To unsubscribe, send mail to [EMAIL PROTECTED] with
> "unsubscribe firewalls" in the body of the message.]
>
-
[To unsubscribe, send mail to [EMAIL PROTECTED] with
"unsubscribe firewalls" in the body of the message.]
