[Guy Harris <gharris@xxxxxxxxx>]

Jerry Talkington wrote:

> You are partially correct.  It is possible for network monitors to
> detect nics in promiscuous mode.

...sometimes.  There's nothing *electrically* different about a 
promiscuous-mode network interface, so there's no guaranteed low-level 
way of detecting a promiscuous interface.  There might be Token Ring 
mechanisms for discovering whether there's a promiscuous-mode interface 
on the network, but there's no Ethernet mechanism of that sort.  I think 
the detection mechanisms detect things such as slower network responses 
from the machine running in promiscuous mode (because, for example, 
they're processing more packets) or perhaps responses to packets that 
the machine wouldn't be expected to respond to - but a machine that's 
running as a *purely* passive sniffer (i.e., not configured to treat any 
packets on the interface as regular network input) might be undetectable.