How to detect a sniffer running. To detect a sniffing device that only collects data and does not respond to any of the information, requires physically checking all your ethernet connections. It is also impossible to remotely check by sending a packet or ping if a machine is sniffing. A sniffer running on a machine puts the interface into promiscuous mode, which accepts all the packets. On some Unix boxes, it is possible to detect a promiscuous interface.
Intruders often replace commands such as ifconfig to avoid detection.
Make sure you verify its checksum. Ultrix can possibly detect someone running a sniffer by using the commands pfstat and pfconfig. These commands only work if sniffing is enabled by linking it into the kernel. Most other Unix systems, such as Irix, Solaris, SCO, etc, do not have any flags indication whether they are in promiscuous mode or not, therefore an intruder could be sniffing your whole network and there is no way to detect it. Often a sniffer log becomes so large that the file space is all used up.