How can I find out that someone is using it's network card in
promiscuous mode in a subnet?

Thank you!


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

How can I find out that someone is using it's network card in
promiscuous mode in a subnet?

Thank you!

_______________________________________________
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos

How can I find out that someone is using it's network card in
promiscuous mode in a subnet?

Thank you!

--
users mailing list
users@lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines

On 3 February 2010 22:11, Vadkan Jozsef <jozsi.avadkan@gmail.com> wrote:
> How can I find out that someone is using it's network card in
> promiscuous mode in a subnet?

http://tinyurl.com/yk3tox4
--
users mailing list
users@lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines

On Wed, Feb 03, 2010, Vadkan Jozsef wrote:
>How can I find out that someone is using it's network card in
>promiscuous mode in a subnet?

We use the swatch log watcher, to detect lines like this in
/var/log/messages (this is from a system running VMware virtual
machines in bridging mode so this is normal):

Jan 28 17:35:57 pogo kernel: device eth1 entered promiscuous mode

Bill
--
INTERNET: bill@celestial.com Bill Campbell; Celestial Software LLC
URL: http://www.celestial.com/ PO Box 820; 6641 E. Mercer Way
Voice: (206) 236-1676 Mercer Island, WA 98040-0820
Fax: (206) 232-9186 Skype: jwccsllc (206) 855-5792

Our Foreign dealings are an Open Book, generally a Check Book.
Will Rogers
_______________________________________________
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos

Vadkan Jozsef <jozsi.avadkan@gmail.com> wrote:

>>
How can I find out that someone is using it's network card in
promiscuous mode in a subnet?
<<

http://sourceforge.net/projects/prodetect/

Best,

--- Les Bell
[http://www.lesbell.com.au]
Tel: +61 2 9451 1144


_______________________________________________
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos

"Les Bell" <lesbell@lesbell.com.au> wrote:

>>
http://sourceforge.net/projects/prodetect/
<<

Sorry - just remembered that's a Windows program. The classic tool for
monitoring IP/Ethernet address pairings is arpwatch, but unlike prodetect,
it will only report an ARP cache poisoning attack, not someone silently
sniffing (which isn't much use on switched networks anyway).

Best,

--- Les Bell
[http://www.lesbell.com.au]
Tel: +61 2 9451 1144


_______________________________________________
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos

On Wed, Feb 03, 2010 at 11:10:44PM +0100, Vadkan Jozsef wrote:
> How can I find out that someone is using it's network card in
> promiscuous mode in a subnet?
>
> Thank you!

This question is off topic on debian-user. Try a network related mailing
list or forum.

--
Chris.


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

On Wed, 03 Feb 2010 23:10:44 +0100
Vadkan Jozsef <jozsi.avadkan@gmail.com> wrote:

> How can I find out that someone is using it's network card in
> promiscuous mode in a subnet?

In principle, this shouldn't be possible, since sniffing is a purely
passive activity. There are various sites that claim the existence of
tools that can somehow do this, although the techniques are not
explained, and the sites are old with broken links:

http://www.securiteam.com/unixfocus/2EUQ8QAQME.html
http://www.grc.com/oo/packetsniff.htm

Celejar
--
foffl.sourceforge.net - Feeds OFFLine, an offline RSS/Atom aggregator
mailmin.sourceforge.net - remote access via secure (OpenPGP) email
ssuds.sourceforge.net - A Simple Sudoku Solver and Generator


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

On Wed, 2010-02-03 at 23:11 +0100, Vadkan Jozsef wrote:
> How can I find out that someone is using it's network card in
> promiscuous mode in a subnet?
>
> Thank you!
>

You can't.
... and even if you could, someone could potentially use a passive
splitter and yank all the packets of the subnet.

Having said all that, if your network is switched (as opposed to using
cheap FE hubs), only broadcast traffic (ARP/DHCP/etc) will be visible in
promisc mode.

- Gilboa

--
users mailing list
users@lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines