[648] in Intrusion Detection Systems
Re: Sniffer Detection
daemon@ATHENA.MIT.EDU (Arve Kjoelen)
Thu Feb 29 10:07:53 1996
Date: Mon, 26 Feb 1996 07:52:40 -0600
From: Arve Kjoelen <akjoele@ee.siue.edu>
To: ids@uow.edu.au
Reply-To: ids@uow.edu.au
> >>What about sniffing inside a firewall. Is there any way yet of possibly detecting a
sniffer?
>
> I participated in a study of this sometime back. Summary, not very likely.
<snip>
Unless, of course, the network admin has access to all machines within the
firewall and (s)he can get the NIC to report that it is in promiscuous
mode.
-Arve.
Arve Kjoelen
Southern Illinois University
Edwardsville, IL 62026
akjoele@ee.siue.edu
