Packet Sniffing
Definition
Capture of network traffic from a wired tap, a switch SPAN port, or a Wi-Fi monitor-mode radio. Passive sniffing reads; active sniffing injects (ARP poisoning, port stealing) to redirect traffic past the sniffer.
- Passive method
- Wired tap, switch SPAN port, Wi-Fi monitor mode
- Active method
- ARP poisoning, port stealing
- Passive effect
- Reads traffic without altering it
- Active effect
- Redirects traffic through the attacker
Common questions
Why is active sniffing detectable when passive sniffing often is not?+
Active techniques like ARP poisoning inject forged packets onto the network, which shows up as duplicate or inconsistent ARP table entries and can be caught by intrusion detection systems, while passive sniffing on a tap or SPAN port leaves no trace on the wire because it never transmits anything.
Why doesn't a switched network stop sniffing on its own?+
A switch normally forwards traffic only to the intended port, but an attacker who can poison ARP caches or gain access to a mirrored SPAN port bypasses that isolation, which is why network segmentation alone is not a complete defence.
Related terms
- ARP Poisoning
- Sending forged ARP replies on a LAN to bind an attacker's MAC to a victim's IP in other hosts' ARP caches, redirecting...
- CVE / KEV
- Common Vulnerabilities and Exposures (MITRE-assigned identifier per public flaw). Known Exploited Vulnerabilities catalogue (CISA), which lists CVEs proven to be actively exploited...
- DDoS (Distributed Denial of Service)
- Service-denial attack sourced from many hosts at once. Volumetric (saturate bandwidth), protocol (exhaust state on stateful boxes), or application-layer (exhaust application resources).
- MITM (Man-in-the-Middle)
- Any attack in which the adversary sits between two endpoints and reads or modifies traffic. ARP poisoning, rogue access points, BGP hijacks...
- OWASP Top 10
- Open Worldwide Application Security Project's ranking of the most common web application security risks, refreshed every 3 to 4 years. Current edition:...