On Jan 30, 8:39am, "Caldwell, Matt" wrote:
} Subject: anti-sniffer warfare
} This week, I was asked to look into a way to tell if
} someone was sniffing on my heterogeneous network. I began to think about
} what and how I would tell. One thing came to mind was SNMP. Because SNMP
} reports the quantity with a receive/rate of the transmissions from the
} Ethernet device you can determine if this is beyond normal expectations
} and investigate further. Usually a sniffer puts the device in
} promiscuous mode which makes the Ethernet device have an excessively
} high rate of traffic.
What's to keep the culprit from reporting fake, but normal-looking,
SNMP statistics?
--- Truck
|
|
