OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Bugtraq archives for 1st quarter (Jan-Mar) 1995: Re: snooper watchers

Re: snooper watchers

Aleph One (aleph1dfw.net)
Thu, 23 Feb 1995 01:55:56 -0600 (CST) 

Here are a few I found:

	http://underground.org/tools/unix/audit/cpm/cpm.1.0.tgz
	http://underground.org/tools/unix/audit/ifstatus/ifstatus.tgz

Dont know if they will work on Solaris 2.x though.


On Wed, 22 Feb 1995, Eric Conrad wrote:

> The first thing many crackers do is replace ifconfig with a trojan that 
> won't report when an interface is in promiscuous mode.
> 
> You could look at 'cpm', which will also show when an interface is 
> promiscuous.  It's available from ftp.cert.org.  You're still in the same 
> boat if someone replaces it with their own, however.
> 
>                               ...Eric
>