[4362] in cryptography@c2.net mail archive
Re: Newsnight Crypto Bazaar
daemon@ATHENA.MIT.EDU (John David Galt)
Sat Mar 20 11:00:25 1999
Date: Sat, 20 Mar 1999 00:30:20 -0800 (PST)
To: cryptography@c2.net
From: John David Galt <jdg@rahul.net>
Quoth Dave Emery:
> Could the packet accounting you do detect covert or overt
>modifications to your switches or switch configuration that caused them
>to copy packet streams sent between two ports to a third port as well ?
>Do you check gross flows to convince yourself that for every packet going
>in only one comes out ?
Why would an eavesdropper need to modify the network configuration? I would
just hook up a sniffer and set it to promiscuous mode.
John David Galt
