Sniffing Techniques in Cybersecurity: Types, Tools and Prevention

Key takeaways

• Passive sniffing listens. Active sniffing changes the network so traffic reaches the sniffer.
• Plain-text protocols (HTTP, FTP, Telnet) expose credentials in a capture. Encrypted ones do not.
• Switches limit what a normal port sees, but mirror ports, compromised devices and wireless networks still matter.
• Capture only on networks you own or are authorised to monitor.

What is sniffing?

A sniffer, or packet analyser, copies packets passing a network interface and shows them in readable form. Network engineers use the same technique daily to troubleshoot. It becomes an attack only when someone captures traffic they have no right to see. Wireshark and tcpdump are standard tools in every network team.

Legal note

Intercepting other people's traffic without permission is an offence under India's Information Technology Act, 2000. Capture only on your own lab or where you have written authorisation.

What are passive and active sniffing?

On a switched wired network a host sees mostly its own traffic and broadcasts, so passive capture there shows little. Wi-Fi is different: frames travel over the air, which is why wireless encryption matters. For one active technique, see DNS spoofing.

Lab: why plain text is dangerous

Do this only on your own machine, with a throwaway test service and fake credentials.

1. Run a local test web server with a simple login form over plain HTTP, and a second one over HTTPS.
2. Start Wireshark capturing on the loopback or lab interface.
3. Log in to the HTTP test service with a fake username and password.
4. Apply the display filter http.request.method == "POST", right-click a packet and choose Follow, TCP Stream. The fake credentials are readable.
5. Repeat with the HTTPS service. The capture shows a TLS handshake and then unreadable data.

That difference is the lesson: encryption turns captured traffic into noise. The Wireshark documentation explains filters and Follow Stream.

What can a capture reveal?

• Credentials sent over HTTP, FTP, Telnet or POP3.
• Which hosts talk to which, and when, even on encrypted traffic.
• DNS lookups, if DNS is not encrypted.
• Session cookies on unencrypted web traffic.

Defences

1. Encrypt everything: HTTPS, SSH, SFTP, TLS for mail, and a VPN on untrusted networks. Retire Telnet and plain FTP.
2. Use switches with port security and dynamic ARP inspection.
3. Control mirror ports and physical access to network jacks.
4. Use 802.1X and WPA3 or WPA2-Enterprise on Wi-Fi.
5. Segment the network so sensitive systems are separate from guests.
6. Monitor for ARP anomalies, duplicate MAC addresses and unexpected access points.
7. Educate users about public Wi-Fi.

Detecting a sniffer

Passive sniffers transmit nothing, so they are hard to find. Check switch configurations for unexpected mirror ports, review ARP tables for conflicts and look for interfaces in promiscuous mode on hosts you manage.

Next steps

Read more in what is network sniffing and how to protect yourself and sniffing attacks and protection. For structured training, see the CEH v13 AI course.

Related reading

• What are the common types of network and application attacks in 2026, and how can you defend against them?
• MAC Spoofing in 2026 | How It Works, Real Risks, and How to Prevent It
• IRDP Spoofing Attack Explained | ICMP Redirect Vulnerabilities & Prevention (2026 Guide)