RE: detecting promiscuous 802.11x cards...
"David Huseby" <[email protected]>
| Newsgroups | gmane.network.wireless.seattle.general |
|---|---|
| Message-ID | <[email protected]> |
-] Code to steal: -] http://www.cmpe.boun.edu.tr/~tas/ -] -] documentation: -] http://www.securityfriday.com/promiscuous_detection_01.pdf Thanks. The detection method takes advantage of the difference between the hardware filter in the nic and software filter in the (Linux/Windows) kernels. By sending a packet that would normally get blocked by the hardware filter (when not in promiscuous mode) but accepted by the software filter we can then assume that all hosts that reply are in promiscuous mode. Unless the Linux kernel has been changed since 2001 to replicate the full hardware filter when a nic is in promiscuous mode, this kind of detection should still work...and work with 802.11 nics as well. Hrm...does anybody know if the Linux kernel has gained some modifications that prevent the kernel from responding to ARP messages with group bits set when the source device is in promiscuous mode? If not, I smell a patch coming... That way I could sniff and detect promiscuous nodes without being detected myself. I wonder if IPTABLEs and the kernel can be made to work together to dump detection ARP packets into a LOG target so that I can log if anybody is scanning for promiscuous mode NICs? Interesting... Dave _______________________________________________ Talk mailing list [email protected] http://seattlewireless.net/mailman/listinfo/talk