What Is Network Sniffing? How It Works, Tools, a Safe Lab and How to Protect Yourself

Key takeaways

• Sniffing is capturing packets, which is lawful only with authorisation.
• Switches limit what a sniffer sees, so attackers use ARP spoofing or rogue access points.
• A two-VM lab shows clear text over HTTP versus encrypted HTTPS.
• Defend with encryption, port security, ARP inspection and segmentation.

What is network sniffing?

Network sniffing means capturing the packets that pass a network interface and decoding them. Administrators use it every day to find out why an application is slow, why a TLS handshake fails or where DNS goes wrong. Attackers use the same technique to read credentials and data that travel unprotected. The tool is neutral. Authorisation decides whether it is troubleshooting or an offence, and under the IT Act, 2000, capturing other people's traffic without permission can be one.

How it works

1. A network card normally accepts only frames addressed to it. In promiscuous mode it passes every frame it sees to the capture software.
2. On an old hub, every port saw every frame. On a modern switch you only see your own traffic, broadcasts and multicast, unless something changes that.
3. To see other devices' traffic, defenders use a SPAN or mirror port or a network tap. Attackers instead try ARP spoofing, MAC flooding or a rogue access point.
4. The software decodes each layer: Ethernet, IP, TCP or UDP, then the application protocol.

Active and passive sniffing

Common tools

• Wireshark is the standard graphical analyser. See the Wireshark documentation.
• tcpdump is the command-line capture tool found on most Linux systems.
• Kismet is used for wireless survey and detection, covered in the Kismet guide.

A safe lab to try it

Do this on your own machine or a virtual lab, never on a shared or office network.

1. Start two virtual machines on a host-only network. Run a plain HTTP page on one, such as python3 -m http.server 8000, and a simple login form of your own.
2. On the other machine, open Wireshark, choose the interface and start a capture.
3. Submit the form, then stop the capture and apply the display filter http.request.method == "POST".
4. Open the packet and read the form fields in clear text. That is the exposure.
5. Repeat with HTTPS (for example a local server with a self-signed certificate) and notice that the payload is encrypted and unreadable.

The point of the exercise is the contrast. Clear-text protocols leak, and encrypted ones do not.

What can sniffing expose?

• Credentials sent over HTTP, FTP, Telnet or plain POP3 and IMAP.
• DNS queries that show which sites you visit.
• Session cookies on unencrypted connections.
• Metadata such as who talks to whom and when, even when content is encrypted.

How do you protect yourself and your network?

• Use HTTPS, SSH, SFTP and secure mail protocols. Retire Telnet and FTP.
• Avoid public Wi-Fi for sensitive work, or use a trusted VPN with caution about what it covers.
• Enable port security, dynamic ARP inspection and DHCP snooping on managed switches.
• Use WPA3 or WPA2 with a strong passphrase on Wi-Fi, and watch for rogue access points.
• Segment networks and monitor for unexpected promiscuous interfaces and ARP anomalies.

Next steps

Read about sniffing attacks and protection and the sniffing techniques guide. To practise packet analysis properly, look at the CEH v13 course.

Related reading

• Wireshark Explained | Mastering Packet Analysis for Ethical Hacking
• What is Wardriving in Cybersecurity? Meaning, Tools, Risks, and How to Protect Your Wi-Fi
• I Used Wireshark to Spy on My Own Internet | Shocking Traffic Insights for Beginners