Re: [gentoo-user] Stealth Ethernet testing

2005-10-22 Thread Hans-Werner Hilse
Hi, On Fri, 21 Oct 2005 19:19:15 + (UTC) James <[EMAIL PROTECTED]> wrote: > Well, after much ado, it seems quite easy (trivial) to hide an ethernet > interface, while being able to collect reems of local ethernet traffic > based data, from both snort and ethereal. No, it's not that easy - d

Re: [gentoo-user] stealth ethernet

2005-10-19 Thread Alexander Skwar
Renat Golubchyk schrieb: > On Wed, 19 Oct 2005 22:50:51 +0200 Alexander Skwar > <[EMAIL PROTECTED]> wrote: >> Justin Patrin schrieb: >> >> > I would suggest using iptables to simply DROP all outgoing packets. >> >> This won't make the host be "stealth". Quite the opposite - it's >> MUCH more visi

Re: [gentoo-user] stealth ethernet

2005-10-19 Thread Renat Golubchyk
On Wed, 19 Oct 2005 22:50:51 +0200 Alexander Skwar <[EMAIL PROTECTED]> wrote: > Justin Patrin schrieb: > > > I would suggest using iptables to simply DROP all outgoing packets. > > This won't make the host be "stealth". Quite the opposite - it's > MUCH more visible. Why? Cheers, Renat -- Pro

Re: [gentoo-user] stealth ethernet

2005-10-19 Thread Alexander Skwar
Renat Golubchyk schrieb: > I don't really know how to do this, but the first thing that came into > my mind was to configure a firewall so that it drops every packet going > outside. Again: This is *NOT* stealth. Such a broken system is very much visible. Alexander Skwar -- gentoo-user@gentoo.o

Re: [gentoo-user] stealth ethernet

2005-10-19 Thread Alexander Skwar
Justin Patrin schrieb: > I would suggest using iptables to simply DROP all outgoing packets. This won't make the host be "stealth". Quite the opposite - it's MUCH more visible. Alexander Skwar -- gentoo-user@gentoo.org mailing list

Re: [gentoo-user] stealth ethernet

2005-10-18 Thread gentuxx
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 James wrote: >Hello, > >For a variety of reasons, I need to be able to make an ethernet >interface on a gentoo system, change into listen only (stealth mode). >Kind of like half duplex, so to speak. Any simple tricks? >Just disabling all responses fro

Re: [gentoo-user] stealth ethernet

2005-10-18 Thread William Kenworthy
wirecutters/stanley knife as appropriate - cut the tx wires in the cable to the card. In one case where the box had to absolutely silent (hacker proof, undetectable monitoring - think it was the honeypot project where I saw this one?), the wires from the socket to the circuit board on the card its

Re: [gentoo-user] stealth ethernet

2005-10-18 Thread Iain Buchanan
You would at the very least have to be detectable in hardware, otherwise the hardware (switch, hub, whatever) won't even talk to you. -- Iain Buchanan <[EMAIL PROTECTED]> -- gentoo-user@gentoo.org mailing list

Re: [gentoo-user] stealth ethernet

2005-10-18 Thread Renat Golubchyk
Hi! On Tue, 18 Oct 2005 23:19:56 + (UTC) James <[EMAIL PROTECTED]> wrote: > For a variety of reasons, I need to be able to make an ethernet > interface on a gentoo system, change into listen only (stealth mode). > Kind of like half duplex, so to speak. Any simple tricks? > Just disabling all

Re: [gentoo-user] stealth ethernet

2005-10-18 Thread Justin Patrin
On 10/18/05, James <[EMAIL PROTECTED]> wrote: > Hello, > > For a variety of reasons, I need to be able to make an ethernet > interface on a gentoo system, change into listen only (stealth mode). > Kind of like half duplex, so to speak. Any simple tricks? > Just disabling all responses from the et

Re: [gentoo-user] stealth ethernet

2005-10-18 Thread Scott Tiret
On Tue, 2005-10-18 at 23:19 +, James wrote: > Hello, > > For a variety of reasons, I need to be able to make an ethernet > interface on a gentoo system, change into listen only (stealth mode). > Kind of like half duplex, so to speak. Any simple tricks? > Just disabling all responses from the