The article mentioned below indicates (to me, anyway) that it might be harder than you think to detect all sniffers: http://www.linuxjournal.com/article.php?sid=6222