> From: Ben <adept @
> To: Gunnar Ingvi Thorisson <gunni @
> Cc: firewalls @
> Subject: Re: Network ethernet sniffer
> > is it possible to detect if a machine and then which machine might be
> > sniffing the network if the machines are about 60 - 70 on that subnet.
> > It would be good to know if it is possible and then how if someone knows.
> You can use programs to detect if there are any ethernet adaptors in
> promiscuous mode.
I assume you're talking about a program you take to the workstation
to run? If not, can you give an example of a program that can determine
promiscuous state remotely? I can't figure out how this would work unless
it detects a whirlpool around the promiscuous NIC <GRIN>