MS Download: Detect Network Sniffers Running On Windows Systems

Sunday, 06 February 2005 by Michel Roth

"There are numerous third party tools that try to detect network sniffers running on the network by looking for signs of systems with network interfaces running in �promiscuous mode.� Since many of these tools use network-based detection techniques that rely on bugs in operating systems and/or specific sniffer behavior, they can generate false positive and false negative results.

Tim Rains has developed a tool that can detect managed Windows systems that have network interfaces running in promiscuous mode � a key indicator that a network sniffer is running on the system. I use a host based detection technique instead of a network based detection technique in order to make this tool as accurate as possible."

Tim Rains built two versions of this tool:

Promqry � a command line tool
PromqryUI � a tool with a GUI

Read more here.