Cuball's WebLog

Network Sniffer identifier

Promqry can accurately determine if a modern (Windows 2000 and later) managed Windows
system has network interfaces in promiscuous mode. If a system has network interfaces in
promiscuous mode, it may indicate the presence of a network sniffer running on the system.

Promqry version 1.0 usage Queries system(s) for interfaces running in promiscuous mode

To query local system's interfaces run:

   promqry.exe

 notes: returns zero if any interfaces found in promiscuous mode

       -returns 1 if no interfaces found in promiscuous mode

       -returns 99 if error encountered

       -np and -nv options are not valid for local query

To query a remote system's interfaces run:

   promqry.exe remote_IP | remote_name  [-nv]

 notes: returns zero if any interfaces found in promiscuous mode

    -returns 99 if error encountered

To query a range of remote systems' interfaces run:

 notes: start_remote_IP must be lower than end_remote_IP

    -np only valid when querying range of systems