FAQ Search Today's Posts Mark Forums Read
» Video Reviews

» Linux Archive

Linux-archive is a website aiming to archive linux email lists and to make them easily accessible for linux users/developers.


» Sponsor

» Partners

» Sponsor

Go Back   Linux Archive > CentOS > CentOS

 
 
LinkBack Thread Tools
 
Old 02-03-2010, 09:10 PM
Vadkan Jozsef
 
Default how to find out promiscuous mode

How can I find out that someone is using it's network card in
promiscuous mode in a subnet?

Thank you!


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
 
Old 02-03-2010, 09:11 PM
Vadkan Jozsef
 
Default how to find out promiscuous mode

How can I find out that someone is using it's network card in
promiscuous mode in a subnet?

Thank you!

_______________________________________________
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos
 
Old 02-03-2010, 09:11 PM
Vadkan Jozsef
 
Default how to find out promiscuous mode

How can I find out that someone is using it's network card in
promiscuous mode in a subnet?

Thank you!

--
users mailing list
users@lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines
 
Old 02-03-2010, 09:18 PM
Sam Sharpe
 
Default how to find out promiscuous mode

On 3 February 2010 22:11, Vadkan Jozsef <jozsi.avadkan@gmail.com> wrote:
> How can I find out that someone is using it's network card in
> promiscuous mode in a subnet?

http://tinyurl.com/yk3tox4
--
users mailing list
users@lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines
 
Old 02-03-2010, 09:28 PM
Bill Campbell
 
Default how to find out promiscuous mode

On Wed, Feb 03, 2010, Vadkan Jozsef wrote:
>How can I find out that someone is using it's network card in
>promiscuous mode in a subnet?

We use the swatch log watcher, to detect lines like this in
/var/log/messages (this is from a system running VMware virtual
machines in bridging mode so this is normal):

Jan 28 17:35:57 pogo kernel: device eth1 entered promiscuous mode

Bill
--
INTERNET: bill@celestial.com Bill Campbell; Celestial Software LLC
URL: http://www.celestial.com/ PO Box 820; 6641 E. Mercer Way
Voice: (206) 236-1676 Mercer Island, WA 98040-0820
Fax: (206) 232-9186 Skype: jwccsllc (206) 855-5792

Our Foreign dealings are an Open Book, generally a Check Book.
Will Rogers
_______________________________________________
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos
 
Old 02-03-2010, 09:45 PM
"Les Bell"
 
Default how to find out promiscuous mode

Vadkan Jozsef <jozsi.avadkan@gmail.com> wrote:

>>
How can I find out that someone is using it's network card in
promiscuous mode in a subnet?
<<

http://sourceforge.net/projects/prodetect/

Best,

--- Les Bell
[http://www.lesbell.com.au]
Tel: +61 2 9451 1144


_______________________________________________
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos
 
Old 02-03-2010, 09:53 PM
"Les Bell"
 
Default how to find out promiscuous mode

"Les Bell" <lesbell@lesbell.com.au> wrote:

>>
http://sourceforge.net/projects/prodetect/
<<

Sorry - just remembered that's a Windows program. The classic tool for
monitoring IP/Ethernet address pairings is arpwatch, but unlike prodetect,
it will only report an ARP cache poisoning attack, not someone silently
sniffing (which isn't much use on switched networks anyway).

Best,

--- Les Bell
[http://www.lesbell.com.au]
Tel: +61 2 9451 1144


_______________________________________________
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos
 
Old 02-03-2010, 10:49 PM
Chris Bannister
 
Default how to find out promiscuous mode

On Wed, Feb 03, 2010 at 11:10:44PM +0100, Vadkan Jozsef wrote:
> How can I find out that someone is using it's network card in
> promiscuous mode in a subnet?
>
> Thank you!

This question is off topic on debian-user. Try a network related mailing
list or forum.

--
Chris.


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
 
Old 02-04-2010, 01:01 AM
Celejar
 
Default how to find out promiscuous mode

On Wed, 03 Feb 2010 23:10:44 +0100
Vadkan Jozsef <jozsi.avadkan@gmail.com> wrote:

> How can I find out that someone is using it's network card in
> promiscuous mode in a subnet?

In principle, this shouldn't be possible, since sniffing is a purely
passive activity. There are various sites that claim the existence of
tools that can somehow do this, although the techniques are not
explained, and the sites are old with broken links:

http://www.securiteam.com/unixfocus/2EUQ8QAQME.html
http://www.grc.com/oo/packetsniff.htm

Celejar
--
foffl.sourceforge.net - Feeds OFFLine, an offline RSS/Atom aggregator
mailmin.sourceforge.net - remote access via secure (OpenPGP) email
ssuds.sourceforge.net - A Simple Sudoku Solver and Generator


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
 
Old 02-04-2010, 06:06 AM
Gilboa Davara
 
Default how to find out promiscuous mode

On Wed, 2010-02-03 at 23:11 +0100, Vadkan Jozsef wrote:
> How can I find out that someone is using it's network card in
> promiscuous mode in a subnet?
>
> Thank you!
>

You can't.
... and even if you could, someone could potentially use a passive
splitter and yank all the packets of the subnet.

Having said all that, if your network is switched (as opposed to using
cheap FE hubs), only broadcast traffic (ARP/DHCP/etc) will be visible in
promisc mode.

- Gilboa

--
users mailing list
users@lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines
 

Thread Tools




All times are GMT. The time now is 11:43 AM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.
Copyright 2007 - 2008, www.linux-archive.org