@mauve Even with such tool, you have absolutely no warranty that a covert stack, operating in supervisor, or directly within the south bridge SoC handling many peripherals, including the default ethernet controller, with an hidden Linux RTOS, is not sending or receiving stuff without the main CPU / OS knowledge. Still it's better than nothing.
Cc @theruran @50htz @vidak @kkarhan @forthy42
@mauve @stman @theruran @50htz @vidak @forthy42 So yeah, your software method may work fine for that...
The transparent analysis option works for stuff that may not get caught easily or systems where you can't shove in adblockers...