From owner-freebsd-questions Thu Jan 18 18:47:26 1996 Return-Path: owner-questions Received: (from root@localhost) by freefall.freebsd.org (8.7.3/8.7.3) id SAA25868 for questions-outgoing; Thu, 18 Jan 1996 18:47:26 -0800 (PST) Received: from mandor.dev.com (mandor.dev.com [198.145.93.1]) by freefall.freebsd.org (8.7.3/8.7.3) with ESMTP id SAA25833 for ; Thu, 18 Jan 1996 18:47:13 -0800 (PST) Received: from mandor.dev.com (localhost [127.0.0.1]) by mandor.dev.com (8.7.3/8.7.3) with ESMTP id SAA04344; Thu, 18 Jan 1996 18:42:36 -0800 (PST) Message-Id: <199601190242.SAA04344@mandor.dev.com> To: David J Meltzer cc: freebsd-questions@freefall.FreeBSD.org, questions@FreeBSD.org Subject: Re: ethernet packet sniffer. In-reply-to: Your message of "Thu, 18 Jan 1996 17:58:29 EST." Date: Thu, 18 Jan 1996 18:42:36 PST From: Brian Smith Sender: owner-questions@FreeBSD.org Precedence: bulk In message , David J Meltzer writes: >Excerpts from internet.computing.freebsd-questions: 18-Jan-96 Re: >ethernet packet sniffer. by marino.ladavac@aut.alcat >> > Mike, I'm not saying it would be practical, but if her networking >> > department happens to have a Time Domain Reflectometer, which is common >> > communications equipment for high speed cables (many cable companies have >> > one) then every tap can be detected. A TDR would spot everything, even >> > unused BNC taps. >> >> So would a Frequency Domain Reflectometer. >> > >Is this for a connection made/not made, or can it actually determine if >a ethernet card on the network is being run in promiscuous mode or not, which >I think was the original question (and if so, could someone explain how)? If the question is whether you can tell if some ethernet card on the net is in promiscuous mode, the answer is no. You can tell if there is a break in the ethernet, or if the ethernet is unterminated, and you might be able to tell if a card is transmitting for more than one source address (with appropriately expensive hardware). But, since ethernet is a broadcast technology, you can't tell if someone "receives" a packet, because they just copy the frame from the signal on the wire. Brian