On some Unix boxes, it is possible to detect a promiscuous interface. It is possible to run a capture utility in non-promiscuous mode, but it will only monitor sessions from the machine it is running on. It is also possible for the intruder to do similiar capture of sessions by trojaning many programs such as sh, telnet, rlogin, in.telnetd, and so on to write a log file of what the user did. They can easily watch the tty and kmem devices as well. These attacks will only compromise sessions coming from that one machine, while promiscuous packet capture compromises all sessions on the ethernet.
Intruders often replace commands such as ifconfig to avoid detection.
Make sure you verify its checksum. Ultrix can possibly detect someone running a packet capture utility by using the commands pfstat and pfconfig. These commands only work if packet capture is enabled by linking it into the kernel. By default, the utility is not linked into the kernel. Most other Unix systems, such as Irix, Solaris, SCO, etc, do not have any flags indication whether they are in promiscuous mode or not, therefore an intruder could be capturing your whole network and there is no way to detect it.