Packet sniffing (also called packet analysis or network sniffing) is the process of capturing and analyzing network traffic (data packets) transmitted over a network. Packet sniffers (network analyzers) can capture all traffic visible on a network segment, including unencrypted passwords, emails, files, and browsing activity. While legitimate for network troubleshooting and security monitoring, malicious packet sniffing (promiscuous mode) can capture sensitive information from unencrypted protocols (HTTP, FTP, Telnet, SMTP, POP3, IMAP).
Attack Prevalence: 40% of data breaches involve packet sniffing (Verizon DBIR). 80% of public Wi-Fi networks are vulnerable to sniffing (Kaspersky 2023). Average detection time: 150 days.
Common targets of packet sniffing attacks:
// Packet sniffing technical flow
1. Network Interface Card (NIC) operates in promiscuous mode
- Normal mode: NIC only captures packets destined for its MAC address
- Promiscuous mode: NIC captures ALL packets on network segment
2. Packet capture process:
- tcpdump/wireshark uses libpcap (Linux) or WinPcap/Npcap (Windows)
- Captured packets are filtered (BPF - Berkeley Packet Filter)
- Packets are dissected/parsed by protocol (Ethernet → IP → TCP → HTTP)
3. Traffic types by visibility:
- Hubs (obsolete): All traffic visible to all ports → full sniffing
- Switches: Only broadcast/multicast traffic visible → need ARP spoofing (MitM)
- Wi-Fi: All traffic visible (promiscuous mode supported)
Capture all traffic on network segment without sending probes. Works on hubs (obsolete) and unswitched networks. Wi-Fi networks support promiscuous mode (monitor mode). Cannot bypass switches.
Attacker performs ARP spoofing to redirect traffic through their machine. Works on switched networks (most modern networks). Enables MitM packet capture.
Network administrator configures switch to copy traffic from one port to another. Legitimate monitoring technique, can be abused by attackers with switch access.
GUI network protocol analyzer. Features: live packet capture, display filters (tcp.port==80), follow TCP streams (reconstruct conversations), protocol dissectors (HTTP, FTP, SMTP), and decryption support (SSL/TLS with keys).
Command-line packet analyzer. Syntax: tcpdump -i eth0 -s 0 -w capture.pcap. Filters: tcpdump -i eth0 'tcp port 80'. Uses BPF (Berkeley Packet Filter) syntax.
Command-line version of Wireshark. tshark -i eth0 -Y 'http.request' -T fields -e http.request.uri.
This demonstration simulates capturing unencrypted HTTP traffic containing credentials:
This is a simulated demonstration. Real packet sniffing can capture passwords from unencrypted protocols (HTTP, FTP, Telnet). Protect yourself by using HTTPS (TLS), VPN on public Wi-Fi, and monitoring for ARP spoofing.
Check if network interface is in promiscuous mode: ifconfig (Linux - PROMISC flag). Windows: netmon, Wireshark, or PowerShell (Get-NetAdapter -IncludeHidden).
ARPwatch (MAC-IP monitoring), XArp (detection tool), Cisco Dynamic ARP Inspection (DAI).
Replace plaintext protocols: HTTP→HTTPS, FTP→SFTP/FTPS, Telnet→SSH, SMTP→SMTPS (STARTTLS). Wireshark cannot decrypt TLS without private keys.
VPN encrypts all traffic (including DNS) between device and VPN server. Prevents sniffing even on untrusted networks. Choose VPN with DNS leak protection.
Enable port security (limit MAC addresses per port), disable unused ports, implement Dynamic ARP Inspection (DAI), and use DHCP snooping.
Best Practice - Encryption + VPN: Use HTTPS (TLS) for all web traffic, SSH instead of Telnet, SFTP instead of FTP, and VPN on public Wi-Fi. Monitor network for ARP spoofing (ARPwatch).
Packet sniffing (unauthorized network interception) is illegal in all jurisdictions:
Packet sniffing without authorization is illegal. Penalties include:
Important: This guide is for educational and defensive purposes only. Unauthorized packet sniffing is illegal.
Official Wireshark documentation: capture filters, display filters, protocol dissection.
tcpdump manual and BPF (Berkeley Packet Filter) syntax guide.