Re: IDS: building an IDS

["Res. Asst. Pars MUTAF" <pmutaf@arf.iyte.edu.tr>]

FAQ: See http://www.ticm.com/kb/faq/idsfaq.html
IDS: See http://www-rnks.informatik.tu-cottbus.de/~sobirey/ids.html
HELP: Having problems.. Then email questions to ids-owner@uow.edu.au
NOTE: You MUST remove this line from reply messages as it will be filtered.
SPAM: DO NOT send unsolicted mail to this list.
USUB: email "unsubscribe ids" to majordomo@uow.edu.au
---------------------------------------------------------------------------



On Wed, 19 May 1999, laurent van-cauwelaert wrote:

> how do i detect sniffer?

you can look at the following address. This is the only
reasonable attempt that i've heard about (excluding
encryption):

http://www.zurich.ibm.com/~dac/Prog_RAID98/Talks.html#Grundschober_31

> 
> first i ve wanted to send a packet to every possible adress on my
> network and looking if the promiscious bit was set, but with 48 bits
> MAC adress, i think i can suppose that it's quite ineficient and stupid,
> but it works, so i m waiting for some better solution
>  
> laurent van cauwelaert (shredder for my friends)
> van-ca_l@epita.fr
> 

Pars MUTAF
Izmir Institue of Technology
TURKEY