North American Network Operators Group
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

RE: sniffer/promisc detector

  • From: Wojtek Zlobicki
  • Date: Fri Jan 16 18:12:48 2004 
Since all sniffers I know of are passive devices, there really shouldn't be
a way to track one down. From a Cisco standpoint, if I were mirroring a
port, and had a sniffer mirroring the sniffer port, I would see traffic of a
unicast nature with multiple unicast MAC destinations destined at a
swithport with only one MAC address cached. 

-----Original Message-----
From: [email protected] [mailto:[email protected]] On Behalf Of
Gerald
Sent: Friday, January 16, 2004 5:35 PM
To: [email protected]
Subject: sniffer/promisc detector


Subject says it all. Someone asked the other day here for sniffers. Any
progress or suggestions for programs that detect cards in promisc mode or
sniffing traffic?

Gerald