Every login, email and file transfer on a network gets cut into small chunks called packets. Packet sniffing means grabbing copies of those packets as they pass by and reading them.
IT teams do it every day to work out why an app is slow. Attackers do it to pick up passwords, session cookies and anything else that travels unencrypted. The technique is the same. The intent is not.
This guide explains how sniffing works, what attackers have actually done with it, how to spot it and how to make it useless. There are tcpdump and Wireshark examples too, so you can see it with your own eyes.
The short version
- Packet sniffing is capturing and reading network traffic. It’s normal on your own network and a problem when someone else does it to you.
- Passive sniffing just listens. Active sniffing tricks the network into sending traffic through the attacker first.
- Encryption is the best defense. A sniffer that captures HTTPS, SSH or VPN traffic gets scrambled data.
- Active attacks often leave traces you can find. A passive sniffer usually leaves none, so plan as if capture is possible.
- MFA limits the damage when a password does get captured.
What is packet sniffing?
Packet sniffing is the capture and inspection of data packets as they travel across a network. Each packet has a header (who sent it and where it’s going) and a payload (the data itself). The software that does the capturing is called a packet sniffer, packet analyzer or network analyzer.
Who uses it:
- Network and IT teams troubleshoot slow apps, dropped connections and strange traffic.
- Security teams investigate incidents and hunt for threats.
- Developers check how an app talks to its servers.
- Attackers collect credentials, session cookies and details about the network. MITRE ATT&CK tracks this as technique T1040, filed under credential access and discovery.
How packet sniffing works
A network card normally ignores packets that aren’t addressed to it. A sniffer switches the card into promiscuous mode, so it hands everything it hears to the software. tcpdump does this by default.
The catch is that a sniffer only sees what reaches its network card. So where it sits matters. These are the usual spots:
- Hubs and shared networks. Every device gets every packet, so capture is easy.
- Open or weakly protected Wi-Fi. Radio signals reach anyone nearby.
- A mirror (SPAN) port or network tap. The switch sends a copy of traffic to a monitoring port. That’s a normal admin feature, and an attacker with access to it gets the same view.
- A compromised machine or network device. Sniffing software can run on a server, a workstation or even a router. MITRE records attackers running captures on network devices.
- The cloud. Traffic mirroring services from AWS, Google Cloud and Azure can copy a virtual machine’s traffic to another instance. MITRE points out that much of that mirrored traffic may be cleartext, because encryption often ends at the load balancer.
Passive vs active sniffing
On an old hub network you can sit back and listen. On a modern switched network, traffic goes only to the port it’s meant for, so an attacker has to do something to get a look. That’s the split between passive and active sniffing.
| Comparison | Passive Sniffing | Active Sniffing |
|---|
| What the attacker does | Listens to and copies network traffic without sending anything. | Interferes with the network so traffic is redirected through the attacker. |
| Where it works | Hubs, open Wi-Fi, mirror ports, and compromised hosts. | Switched networks, where traffic normally goes only to its intended port. |
| Common techniques | Promiscuous mode capture and Wi-Fi monitoring. | ARP spoofing, MAC flooding, DNS spoofing, and rogue DHCP. |
| Easy to detect? | No. It can leave very little evidence on the network. | Often yes. It can create unusual ARP, DHCP, or DNS activity. |
| Best defense | Encryption. | Switch hardening plus encryption. |
ARP spoofing is the classic active trick. The attacker announces that they are the gateway, so other devices send their traffic to the attacker, who copies it and passes it on. Nothing looks broken to the user. MAC flooding overloads a switch’s address table so that some switches start sending packets out of every port, like a hub.
A quick note on terms. Here, spoofing means faking a network identity, like ARP or DNS spoofing. If you’re after fake sign-in pages that steal passwords, that’s a different attack, covered in our guide to login spoofing.
Real attacks that used packet sniffing
Sniffing sounds theoretical until you look at the cases.
Firesheep (2010)
In October 2010, developer Eric Butler released Firesheep, a Firefox extension, at the ToorCon security conference. It scanned open Wi-Fi networks for session cookies and let anyone on the same network take over other people’s Facebook, Twitter and other accounts with a double click, as reported at the time.
The weakness it exposed was simple. Many sites encrypted the login page but sent the session cookie over plain HTTP afterwards. Butler said he built the tool to push sites toward HTTPS, and Dark Reading covered his goal the same week.
The 2015 attack on Ukraine’s power grid
During the 2015 attack on Ukraine’s electric power system, the Sandworm Team used a network sniffer module in the BlackEnergy malware to discover user credentials moving between the local network and the grid’s industrial control systems, according to MITRE ATT&CK.
Sniffing was one step in a much larger operation. It still shows why credentials crossing any internal link need protection, not only the ones facing the internet.
DarkVishnya: banks in Eastern Europe
Between 2017 and 2018, Kaspersky investigated a series of thefts at at least eight banks in Eastern Europe, with damage estimated in the tens of millions of dollars. The attackers walked in posing as couriers or job seekers and plugged a small device into the bank’s network, often in a meeting room. It was a cheap laptop, a Raspberry Pi or a Bash Bunny USB tool.
From there they scanned the network and tried to brute force or sniff login details for the machines used to make payments. The way in was a physical device, not a phishing email.
If you run a bank or fintech, our financial industry page has more on how OmniDefend supports financial organizations.
The thread through all three is credentials that crossed a network without enough protection. MITRE also lists APT28 close-access teams using Wi-Fi Pineapple devices to intercept Wi-Fi signals and credentials, so rogue access points belong on your watch list too.
What a sniffer can and can’t see
Traffic | What a sniffer sees |
|---|
Login form on a plain HTTP page | Username and password in readable text |
Login on an HTTPS page | Scrambled payload. It can still see IP addresses, timing, data size and usually the site name |
FTP, Telnet and other older protocols | Passwords and content in plain text |
Unencrypted DNS lookups | Which domains your device asks for |
Session cookie sent over HTTP | The cookie value, which can be enough to take over the session |
One-time code typed into an HTTP page | The code. It expires quickly, but a fast attacker can use it |
MITRE singles out credentials sent over insecure, unencrypted protocols as the main prize, and the table lines up with that. The problem is rarely the sniffer itself. It’s the plain text.
Even with HTTPS in place, a sniffer can map who talks to whom and when. MITRE notes that sniffing may reveal running services, version numbers, IP addresses and hostnames, which is useful for planning a later attack.
Packet sniffer tools and examples
Tool | Best for | Good to know |
|---|
Wireshark | Visual analysis and learning | Free and open source, with a graphical interface and display filters |
tcpdump | Quick captures on servers, over SSH | Command line, usually needs root, can save .pcap files |
Snort | Intrusion detection | Open source IDS/IPS that can also log packets |
These tools are not malicious. Attackers borrow them for the same reason admins use them, because they work. What matters is whether you’re authorized to be capturing.
A few tcpdump commands
sudo tcpdump -i eth0 -nn -c 20
sudo tcpdump -i eth0 -nn port 53
sudo tcpdump -i eth0 -w capture.pcap
- -i eth0 picks the network interface.
- -nn skips name lookups, so you see raw IP addresses and port numbers.
- -c 20 stops after 20 packets.
- port 53 shows only DNS traffic.
- -w capture.pcap saves the capture to a file you can open in Wireshark.
Handy Wireshark display filters
- http shows only HTTP traffic.
- dns shows name lookups.
- arp shows address resolution traffic, useful when you suspect spoofing.
- ip.addr == 192.168.1.10 shows traffic to or from one device.
- http.request.method == “POST” shows form submissions.
- tls shows encrypted web traffic.
Try it yourself: a 15 minute lab
Only do this on a lab network you own, with devices you own or have written permission to test.
- Set up a test site with a login form over plain HTTP. A practice app such as DVWA, running in a virtual machine, works well.
- Open Wireshark and start a capture on the lab network interface.
- Log in with a fake account.
- Stop the capture, apply the filter http.request.method == “POST” and click the packet. Expand the HTML Form URL Encoded section. The username and password are right there in plain text.
- Repeat the login over HTTPS and filter by tls. You’ll see the handshake and encrypted data, and no form fields.
- Right click a packet in each capture and choose Follow, then TCP Stream. Put the two views side by side.
The gap between step 4 and step 5 is the whole case for encrypting internal traffic.
How to detect packet sniffing
Be realistic about what’s possible. Active attacks like ARP spoofing disturb the network and can be caught. A purely passive sniffer on a hub, a tap or a mirror port sends nothing, so there’s nothing to see from the network side. Here’s what’s worth doing.
- Check ARP tables for oddities. Run arp -a on Windows or macOS, or ip neigh on Linux. Warning signs are one IP address answered by two different MAC addresses, or the gateway’s MAC address suddenly changing.
- Look for network cards in promiscuous mode. On Linux, ip link show lists a PROMISC flag when it’s on. Some legitimate tools turn it on too, so find out who owns it before you panic.
- Hunt for devices that shouldn’t be there. DarkVishnya started with small laptops, Raspberry Pis and USB tools plugged into the network. Review switch port reports for unknown MAC addresses, and consider 802.1X so unknown devices can’t join.
- Turn on switch protections. Port security, DHCP snooping and dynamic ARP inspection (names vary by vendor) block or flag the usual active tricks.
- Alert on sniffing tools and mode changes. MITRE’s detection guidance suggests watching for tools like Wireshark, tshark and tcpdump starting up, for drivers loading that point to promiscuous mode, and for interfaces switching into that mode.
- Audit your cloud mirroring. Log who creates traffic mirror sessions, and who is allowed to.
- Scan for rogue Wi-Fi access points near your offices.
- Consider a honeypot. It won’t find a sniffer, but a decoy system that no real user should touch can show you someone moving around your network. We cover how in our guide to honeypots.
If you need tools for monitoring and alerting, our roundup of network security tools is a good place to start.
How to prevent packet sniffing (or make it useless)
You can’t always stop capture. You can make sure that what gets captured isn’t worth much.
- Encrypt everything in transit. Use HTTPS with HSTS, SSH instead of Telnet, SFTP instead of FTP, and a VPN on public Wi-Fi. MITRE lists encryption first among its mitigations, and that’s where we’d start too, because it works no matter where the sniffer sits. Remote staff need this most, so see how OmniDefend handles secure work from home. For personal setups, our home network tips cover the basics.
- Lock down the switch ports. Disable unused ports, turn on port security and use 802.1X. Keep visitors away from open wall sockets and meeting room ports.
- Block ARP and DHCP tricks. Dynamic ARP inspection and DHCP snooping stop most spoofing attempts at the switch.
- Segment the network. MITRE recommends segmentation to keep broadcast and multicast sniffing contained. It also limits how much a single capture can reveal. If you want protocol background, our SMB deep dive covers one of the protocols attackers like to poison.
- Harden cookies and sessions. Use HTTPS on every page, not only the login, and set the Secure, HttpOnly and SameSite flags on session cookies. Firesheep worked because sites skipped the first part. Keep session lifetimes sensible.
- Add MFA so a stolen password isn’t enough. MITRE lists multi-factor authentication as a mitigation too. Not all MFA is equal, though. A one-time code can be sniffed or intercepted, even if it expires quickly. FIDO2 sign-ins use a signed response that can’t be replayed on another site, which is why we point people toward phishing-resistant MFA and explain how FIDO2 works. MFA isn’t bulletproof, and we say so plainly in how hackers bypass 2FA. For the bigger picture, see what cyberattacks MFA actually stops.
- Limit who can capture traffic. Keep admin rights tight, and in the cloud restrict who can create or change traffic mirrors. MITRE flags this as a mitigation as well.
Where OmniDefend fits
Let’s be straight about what we do and don’t do. OmniDefend can’t stop someone from capturing packets on a network. Encryption and network controls handle that. What we do is make a captured password far less useful, and give you the records to see what happened afterwards.
- Multi-factor authentication supports fingerprint, face, smart cards, one-time passwords, a mobile authenticator with push messages and FIDO2 WebAuthn.
- Single sign-on lets staff sign in once instead of typing a password into every app, so fewer credentials are in motion.
- Windows desktop security brings strong authentication to the desktop sign-in.
- Auditing and reporting gives admins real-time reports on who authenticated, when, how and from which IP address, and you can export them.
OmniDefend can also check signals like location, device and IP address before it asks for a second factor, and it runs in the cloud, in a hybrid setup or on premises. You can see the full range on the workforce protection page. For customer-facing services, transaction verification applies the same idea to your users.
Frequently asked questions
Is packet sniffing illegal?
It depends on whose network it is and whether you have permission. Capturing traffic on your own network, or one you’re authorized to test, is routine work. Capturing other people’s traffic without consent can break wiretapping or computer misuse laws in many countries. Get written permission before testing and check your local rules.
Can HTTPS stop packet sniffing?
It stops a sniffer from reading the content. The sniffer can still see which IP addresses you talk to, when, and how much data moves, and often the site name too.
Does a VPN protect me from sniffing?
A VPN encrypts traffic between your device and the VPN server, so someone on the same Wi-Fi sees scrambled data. It doesn’t protect traffic after the VPN server, and it doesn’t help if your device is already compromised.
Is Wireshark a hacking tool?
No. It’s a standard network analysis tool used by IT and security teams every day. What matters is whether you’re authorized to capture on that network.
Can a firewall detect a packet sniffer?
Not on its own. A passive sniffer sends no traffic, so there’s nothing for a firewall to block. Switch features such as dynamic ARP inspection, and intrusion detection tools, can catch active attacks like ARP spoofing.
What’s the difference between sniffing and spoofing?
Sniffing is reading traffic. Spoofing is faking an identity, like an IP address, a MAC address, a DNS answer or a login page. Attackers often combine them. ARP spoofing, for example, is used to make sniffing possible on a switched network.
Can someone sniff my home Wi-Fi?
Anyone who can receive your signal can try to capture it. WPA2 or WPA3 on your network and HTTPS on the sites you visit keep the contents unreadable to people outside your network. Our home network tips walk through the setup.
Make a stolen password worthless
Sniffing will always be part of the threat picture. The goal isn’t to stop every packet from being read. It’s to make sure that what gets read can’t open the door.
If your team still signs in to important apps with a password alone, now is a good time to change that. Start your 30 day free trial of OmniDefend and our team will set it up with you, so you can see how it works in your own environment.
If you’re comparing providers, thirty days is long enough to run OmniDefend with a real team, which is the best way to judge any security partner. We’d be glad to have you try it.
Would you rather talk it through first? Request a demo, look at pricing or contact us. You can also start from the OmniDefend homepage to see everything we offer.
Sources
- MITRE ATT&CK. Network Sniffing, Technique T1040. https://attack.mitre.org/techniques/T1040/
- Kaspersky Securelist. DarkVishnya: Banks attacked through direct connection to local network (December 2018). https://securelist.com/darkvishnya/89169/
- The Hacker News. New Firefox add-on Firesheep hijacks Facebook, Twitter sessions (October 2010). https://thehackernews.com/2010/10/new-firefox-add-on-firesheep-hijacks.html
- Dark Reading. New Firefox Plug-In Offers WiFi Cookie-Jacking For Average Joe (October 2010). https://www.darkreading.com/attacks-breaches/new-firefox-plug-in-offers-wifi-cookie-jacking-for-average-joe-
- Red Hat. Packet sniffer basics for network troubleshooting. https://www.redhat.com/en/blog/packet-sniffer-basics
