Oh, joy! Part of your message slipped by me. Apologies for polluting the
list.
> > There are some techniques for identifying a machine that has its
> > interface is promiscuous mode (i.e. is running a sniffer).
> > Specifically, since a machine in promiscuous mode is essentially
> > processing every packet on its segment, its response times will
> > differ from other non sniffing machines.
>
> Nice method. But don't you need a lot of information about the
> machines on the network (what hardware, what load) before you can
> count on this?
Not really. If you can aritifically increase the amount of traffic on the
network to the point of saturation, you can sample response times before and
during the saturation. If the segment is already very loaded, there will
still be observable differences from expected response times.
