2

Many attacks I was reading about require the NIC on the attackers laptop to be in promiscuous mode, and in fact this can be detected, for example with this NSE script for NMAP:

https://nmap.org/nsedoc/scripts/sniffer-detect.html

So this script relies on ARP and hoping to hear a response to an ARP request that should in normal circumstances not take place.

or

http://www.oxid.it/ca_um/topics/promiscuous-mode_scanner.htm

Would I hide from such scans when using a Receive-only cable https://web.archive.org/web/20150415194325/http://www.infosecwriters.com/hhworld/hh9/roc/node3.html

or even by disabling all protocols on the NIC:

enter image description here

cyzczy
  • 1,518
  • 5
  • 21
  • 34

0 Answers0