On some Unix boxes, it is possible to detect a promiscuous interface. It is possible to run a sniffer in non-promiscuous mode, but it will only capture sessions from the machine it is running on. It is also possible for the intruder to do similiar capture of sessions by trojaning many programs such as sh, telnet, rlogin, in.telnetd, and so on to write a log file of what the user did. They can easily watch the tty and kmem devices as well. These attacks will only compromise sessions coming from that one machine, while promiscuous sniffing compromises all sessions on the ethernet.
Intruders often replace commands such as ifconfig to avoid detection.
Make sure you verify its checksum. Ultrix can possibly detect someone running a sniffer by using the commands pfstat and pfconfig. These commands only work if sniffing is enabled by linking it into the kernel. Most other Unix systems, such as Irix, Solaris, SCO, etc, do not have any flags indication whether they are in promiscuous mode or not, therefore an intruder could be sniffing your whole network and there is no way to detect it. Often a sniffer log becomes so large that the file space is all used up.