It is possible to sniff packets through an unplumbed interface, so the interface can not be detected, remaining invisible to detection and attack.
I’m not sure if this works in all configurations, but here goes the trick:
ifconfig hme0 plumb
ifconfig hme0 192.168.100.50 netmask 255.255.255.0 up
ifconfig hme0 unplumb
Now the fun…
snoop -d hme0
Now the sniffer will silently gather all traffic on the wire and hme0 interface will not respond to any traffic.