> Also, paranoid network administrators might be a little upset by it, since > Linux sends out a frame indicating it is switching into (or out > of) promiscuous mode. This is possible evidence that you're running a > sniffer of some kind (such as snort). Hi, How can I recognize such frames/packets? I know this isn't very effective method when trying to discover sniffers, but worth a shot. Is there a way to disable those frames/packets? Jaan a bit paranoid :)