Date: Mon, 15 Feb 1999 14:31 EST From: Barney Wolff <barney@databus.com> To: freebsd-net@FreeBSD.ORG Subject: Re: Router stats & NIC in prom. mode... Message-ID: <36c877540.71db@databus.databus.com>
next in thread | raw e-mail | index | archive | help
Send a packet to the IP of the suspect machine, with a "wrong" MAC. If it answers, it's snooping. Not surefire, of course, but probably works unless the bad guy has altered the net code. Clipping the xmit lead is harder than it used to be. Barney Wolff <barney@databus.com> > From: "Louis A. Mamakos" <louie@TransSys.COM> > Date: Mon, 15 Feb 1999 13:55:12 -0500 > > > > Also, I need a program that checks the local ethernet for network cards > > > that are in promiscous(sp) mode.. i found a few, but none would compile on > > > FreeBSD.. if anyone can recommend anything it would be appriciated. > > I'm really curious. What mechanism can you use to detect that another > Ethernet MAC is accepting all frames, rather than filtering on multicast, > broadcast or frames addressed to the built-in MAC address? To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-net" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?36c877540.71db>