3 ms·
The program doesn't set up a listening socket (which would show up in netstat), it's doing what is normally the kernel's job (analyzing traffic on the interface
by renaudg 12y ago
The program doesn't set up a listening socket (which would show up in netstat), it's doing what is normally the kernel's job (analyzing traffic on the interface and parsing IP packets) all by itself in userspace.
- tptacek 12y agoAnd it's using libpcap to do it, making it (in that regard) asymptotically as sophisticated as dsniff. It appears to literally be using cd00r, which FX wrote almost 15 years ago. It's like they assembled it out of junkyard parts from PacketStorm.