During the intelligence-gathering phase of a penetration test, you discover a press release by a security products vendor stating that they have signed a multi-million dollar agreement with the company you are targeting. The contract was for vulnerability assessment tools and network based IDS systems.
While researching on that particular brand of IDS you notice that its default installation allows it to perform sniffing and attack analysis on one NIC and is managed and sends reports via another NIC. The sniffing interface is completely unbound from the TCP/IP stack by default. Assuming the defaults were used, how can you detect these sniffing interfaces?