Re: "closed-port" backdoors

[Andreas Hasenack <andreas () CONECTIVA COM BR>]

Em Thu, Mar 22, 2001 at 12:06:34AM -0600, Frank Knobbe escreveu:
> If the back door is capable of detecting SYN's, then I would guess it
> is running the NIC in promiscuous mode. Instead of opening a port

No, it opens a raw socket, just like one or two of portsentry's modes.