Ypghost effectively adds false (ghost) entries to NIS maps. It does this by watching the local network for UDP packets that are calls to the YPPROC MATCH function of the RPC program YPPROG, and then sends out false replies. Ypghost performs NIS spoofing.