# Sniffing

> Chapter 8 of the Courseiva EC-CEH curriculum — https://courseiva.com/learn/ec-ceh/sniffing

**Official objective:** 5.1 — Capture network traffic and analyze packet data using sniffing tools and techniques, including ARP poisoning.

## Introduction

Exam domain 5.0, Network and Perimeter Security, includes a major skill: capturing network traffic and analysing packet data using sniffing tools and techniques such as ARP poisoning. Sniffing matters because it’s the primary way attackers steal unencrypted data like passwords, emails, and chat messages, and it’s also how network administrators diagnose problems. For the 312-50 exam, you need to understand how sniffing works, what tools do it, and how to defend against it.

## The Open Envelope Analogy

Have you ever sent a postcard in the mail?

Think about what happens when you drop a postcard into a mailbox. You write a message on the back, put the address on the front, and drop it in. From that point on, every postal worker, every sorting machine, and anyone who happens to glance at that postcard as it travels can read your message. Unlike a letter in a sealed envelope, a postcard is open for anyone along the route to see. That’s exactly how data travels across a network. When your laptop sends a message to a website, it doesn’t travel in a sealed tunnel. Instead, it gets broken into small pieces called packets, and each packet is like a postcard: it has a destination address, a return address, and the message itself. Every device that the packet passes through on its journey can, in theory, peek at the contents. Normally, devices are polite and only look at packets addressed to them. But an attacker can put their network card into a special mode, called promiscuous mode, that makes it read every single packet that passes by, even ones meant for other devices. This act of capturing and reading those packets is called sniffing. It’s the digital equivalent of standing in a post office and reading every postcard that comes through the sorting room.

## Core explanation

To understand sniffing, you first need to understand the basic building block of network communication: the packet. A packet is a small chunk of data that travels from one device to another across a network. Think of it like a postcard: it has a header (the address part) and a payload (the message). The header contains the source IP address (where it came from) and the destination IP address (where it is going). The payload is the actual data being sent, like a password or a web page request.

When you connect to a website, your computer doesn't send one giant piece of data. Instead, it chops the data into hundreds or thousands of packets and sends them out one by one. Each packet takes its own path through the network, hopping from router to router until it reaches the destination. At each hop, a router looks at the destination IP address and decides where to send the packet next. Normally, a device (like a switch or a router) only sends a packet to the device that is supposed to receive it. But sniffing exploits a loophole in how network hardware works.

In older networks, called bus topologies, every device shared the same wire. When your computer sent a packet, every other computer on that wire could see it by default. Modern networks use switches instead. A switch is a smart device that learns which device is connected to which port and only sends packets to the correct port. This makes it harder to sniff because you don't get to see traffic meant for other devices. But attackers have a trick: ARP poisoning.

ARP stands for Address Resolution Protocol. Its job is to map IP addresses (like 192.168.1.1) to physical MAC addresses (like AA:BB:CC:DD:EE:FF). MAC addresses are permanent hardware addresses burned into network cards. When your computer wants to talk to another computer on the same local network, it sends out an ARP request: 'Who has IP address 192.168.1.5? Tell me your MAC address.' The device with that IP replies with its MAC address. Your computer then saves that mapping in a small table called the ARP cache for future use.

In ARP poisoning, an attacker sends fake ARP replies to the network. For example, the attacker tells the victim's computer, 'The gateway (the router that leads to the internet) is at my MAC address.' The victim believes that lie and updates its ARP cache. Now, when the victim sends a packet meant for the internet, it actually sends it to the attacker's computer. The attacker can then read the packet, record any sensitive data, and then forward the packet to the real gateway so the victim doesn't notice anything is wrong. This is called a man-in-the-middle attack. The attacker is literally in the middle of the conversation.

Sniffing can be done using software tools called packet sniffers. The most famous one is Wireshark. Wireshark captures all the packets that travel through a network interface on your computer and displays them in a readable format. It shows the header details, the payload, and even allows you to filter for specific types of traffic, like passwords sent over HTTP (unencrypted web traffic). Other tools include tcpdump (a command-line sniffer) and bettercap (which combines sniffing with ARP poisoning).

Sniffing is only effective against unencrypted traffic. If a website uses HTTPS (the padlock in your browser), the payload is encrypted, so even if you sniff the packet, you only get scrambled data. However, many older protocols, such as FTP (File Transfer Protocol), Telnet (remote command line), and HTTP itself, send everything in plaintext. An attacker sniffing the network can capture usernames, passwords, and file contents without any decryption. This is why the exam emphasises the importance of encryption protocols like SSH (Secure Shell) and HTTPS.

There are two main types of sniffing: passive and active. Passive sniffing means you just listen to traffic that is already coming your way—you don't interfere with the network. It works on old hub-based networks or if you are already connected to the same switch port as the victim. Active sniffing means you actively manipulate the network, usually via ARP poisoning or other attacks, to redirect traffic to your device. Active sniffing is louder and easier for security tools to detect, but it allows you to capture traffic that wouldn't normally reach you.

## Real-world context

Imagine you work as a security analyst for a medium-sized company. One morning, the helpdesk gets reports that employees in the finance department are experiencing slow internet and occasional disconnections. You suspect a network issue, but you also want to check for malicious activity.

First, you install Wireshark on a laptop and connect it to a mirror port on the switch. A mirror port is a special port that copies all traffic passing through the switch, allowing you to see everything without being in the way. You start a capture and see thousands of packets per second. Most of it is normal web traffic, but you notice a surprising number of ARP packets—more than usual. Specifically, you see ARP replies claiming that the gateway’s IP address belongs to a MAC address that is not the actual router.

You then use a tool called arpwatch to monitor the ARP table on the network. It confirms that the gateway MAC address has changed several times in the last hour. This is a classic sign of ARP poisoning. An attacker is spoofing the gateway to intercept traffic.

Now you act. You isolate the suspect device by looking at which switch port the malicious MAC address is connected to. You walk over to that location, find a small Raspberry Pi hidden under a desk, and disconnect it from the network. You then clear the ARP cache on all affected computers using the command 'arp -d *' on Windows or 'ip neigh flush all' on Linux. The network returns to normal.

Next, you review the captured packets from Wireshark to see what data was stolen. You filter for HTTP traffic and find that several employees logged into a vendor portal using HTTP instead of HTTPS. Their usernames and passwords appear in plaintext in the packet payload. You immediately force a password reset for those accounts and notify the vendor to check for any unauthorised access.

Finally, you implement a permanent fix: you enable port security on the switches to limit how many MAC addresses can be learned per port, and you deploy a tool called DHCP snooping that validates ARP packets. You also configure your network monitoring system to alert staff when there is a sudden spike in ARP traffic. From now on, you regularly run passive sniffing audits to detect any unauthorised devices or suspicious ARP activity before it becomes a breach.

## Exam focus

The 312-50 exam tests sniffing in several specific ways. Expect around 10-15 questions on this topic. The most common question type presents a scenario: 'An attacker wants to capture traffic between two hosts on the same switch. Which technique should they use?' The correct answer is ARP poisoning. They love testing the difference between passive and active sniffing.

Another frequent question: 'Which protocol is vulnerable to sniffing?' They list options like HTTPS, SSH, Telnet, and SFTP. The correct answer is Telnet because it sends everything in plaintext. Memorise the list of plaintext protocols: Telnet, FTP, HTTP, POP3 (email), IMAP (email), SNMP (network management).

They also test tools. You must know that Wireshark is the primary graphical packet analyser, tcpdump is the command-line equivalent, and bettercap is a modern tool that combines sniffing with ARP poisoning. A typical question: 'Which tool would an ethical hacker use to capture and analyse network packets?' Answer: Wireshark.

The exam loves ARP poisoning details. Key facts to memorise:

- ARP is a protocol that maps IP addresses to MAC addresses.
- ARP poisoning involves sending forged ARP replies.
- The attacker's goal is to become a man-in-the-middle.
- Defences include dynamic ARP inspection (DAI), port security, and DHCP snooping.
- ARP poisoning only works on local networks (same broadcast domain).

Another trap: they ask about sniffing on a switch versus a hub. On a hub, all traffic is broadcast to all ports, so an attacker can sniff passively. On a switch, traffic is only sent to the correct port, so the attacker must use active sniffing (like ARP poisoning) to redirect traffic. They might ask: 'Why is it more difficult to sniff traffic on a switched network compared to a hub-based network?' The answer: because a switch forwards frames only to the destination port, not all ports.

They also ask about promiscuous mode. A network card in normal mode only processes packets addressed to its own MAC address. In promiscuous mode, the card reads every packet it sees, even those not meant for it. This is required for any sniffing tool to work. A related question: 'Which mode must a network interface card (NIC) be in to perform packet sniffing?' Answer: promiscuous mode.\

Finally, they test your understanding of encryption. A common question: 'Which traffic is immune to sniffing?' The answer is encrypted traffic, such as HTTPS, SSH, SFTP, and IPsec. But remember, even encrypted traffic can be sniffed; the attacker just can't read the payload without the key. So the nuance is that sniffing still captures the packets, but the data remains confidential.

## Step by step

1. **Configure the network card** — Put the network interface card (NIC) into promiscuous mode so it accepts all packets, not just those addressed to it. This is done automatically by most sniffing tools. Without this step, the OS discards packets not meant for your MAC address.
2. **Select the capture interface** — Choose which network interface (e.g., Ethernet, Wi-Fi) to capture on. In Wireshark, this is the first screen you see. If you have multiple adapters, you need to select the one connected to the target network.
3. **Begin packet capture** — Start the capture. The tool will begin collecting every packet that passes through the interface. On a busy network, this can generate thousands of packets per second. You can stop the capture at any time.
4. **Apply filters (if needed)** — Use display filters to focus on specific types of traffic. For example, 'http' shows only HTTP packets, 'arp' shows only ARP packets, and 'ip.src==192.168.1.1' shows only packets from that IP. Filters make it manageable to find useful data.
5. **Analyse the packets** — Click on a packet to see its details. Expand the protocol layers to view headers. Look for plaintext passwords in the payload. Tools like Wireshark also have 'Follow TCP Stream' to reassemble a full conversation (like a login sequence) from multiple packets.
6. **Perform ARP poisoning (if switching network)** — If you are on a switched network and want to sniff traffic between two other devices, you need to run an ARP poisoning tool. Bettercap or arpspoof can send forged ARP replies so that the victim and gateway both send traffic through you. Once traffic flows through your machine, you can capture it in step 3.

## Comparisons

### Passive Sniffing vs Active Sniffing

**Passive Sniffing:**
- Attacker does not send any packets; they only listen to existing traffic.
- Works on hubs or when connected to a switch port that already sees the target traffic.
- Less likely to be detected because no extra traffic is generated.

**Active Sniffing:**
- Attacker sends forged packets (e.g., ARP replies) to redirect traffic.
- Required on switched networks where traffic does not naturally reach the attacker.
- More detectable because the forged packets can be flagged by security tools.

### Hub vs Switch

**Hub:**
- Broadcasts all incoming traffic out of every port.
- Simple, older technology; no intelligence to direct traffic.
- Easy to sniff: any device on any port sees all traffic.

**Switch:**
- Forwards traffic only to the specific port where the destination device is connected.
- Uses MAC address table to learn which device is on which port.
- Harder to sniff: requires active techniques like ARP poisoning to see other devices' traffic.

### ARP Request vs ARP Reply

**ARP Request:**
- Sent as a broadcast to all devices on the local network.
- Asks 'Who has this IP address? Please tell me.'
- Does not contain the MAC address of the requester's target; only the requester's own MAC.

**ARP Reply:**
- Sent as a unicast directly to the requesting device.
- Answers the request: 'I have that IP. My MAC is XX:XX:XX:XX:XX:XX.'
- Can be spoofed: an attacker can send a fake reply claiming a different MAC for a given IP.

## Diagram

_This diagram shows how an attacker uses ARP poisoning to become a man-in-the-middle, intercepting traffic between a victim computer and the gateway._

```mermaid
flowchart TD
    A[Victim Computer] -->|Sends ARP request: Who has gateway IP?| B[Gateway (Router)]
    C[Attacker] -->|Fake ARP reply: Gateway IP is at attacker MAC| A
    C -->|Fake ARP reply: Victim IP is at attacker MAC| B
    A -->|Sends packet for internet| C
    C -->|Reads and forwards packet| B
    B -->|Response packet| C
    C -->|Reads and forwards response| A
```

## Common misconceptions

- **Misconception:** Sniffing only works if you have physical access to the network. **Reality:** Sniffing can be done remotely if you have already gained access to a device on the local network, for example through malware or a compromised account. You don't need to be in the same room. (Beginners imagine hackers physically plugging a cable into a network. In reality, once you control any device on the network, you can run sniffing software from that device.)
- **Misconception:** ARP poisoning is a form of sniffing. **Reality:** ARP poisoning is a technique used to enable sniffing on a switched network; it is not sniffing itself. Sniffing is the act of capturing packets, and ARP poisoning is the method to redirect packets to you so you can sniff them. (People conflate the attack method with the goal. The exam clearly separates the two concepts.)
- **Misconception:** Wireshark can only capture traffic meant for your computer. **Reality:** Wireshark can capture any traffic that passes through your network interface, including packets not meant for your computer, provided the card is in promiscuous mode and you are on a hub or have performed ARP poisoning. (Most beginners only use Wireshark on their own machine and see only their own traffic. They assume that's all it can do.)
- **Misconception:** HTTPS traffic cannot be sniffed. **Reality:** HTTPS traffic can still be sniffed and captured; the packets are visible to anyone on the network. The difference is that the payload is encrypted, so the attacker cannot read the contents without the decryption key. Sniffing works on all traffic, but reading the data requires breaking the encryption. (Marketers and browsers give the impression that HTTPS is 'secure' from all eavesdropping, but it only protects the contents, not the metadata (who is talking to whom).)

## Key takeaways

- Sniffing is the act of capturing network packets to read the data they contain. 
- ARP poisoning is an active sniffing technique that sends fake ARP replies to redirect traffic through the attacker's device.
- A network card must be in promiscuous mode to capture packets addressed to other devices.
- Passive sniffing works on hubs because they broadcast all traffic to every port; active sniffing is required on switched networks.
- Plaintext protocols like Telnet, FTP, and HTTP are the most vulnerable to sniffing because they send credentials and data unencrypted.
- Wireshark is the most popular tool for packet capture and analysis, and tcpdump is its command-line counterpart.
- Defences against sniffing include encryption (HTTPS, SSH), dynamic ARP inspection, port security, and DHCP snooping.
- Sniffing itself is a passive monitoring technique and is legal when performed by a network administrator on their own network; ARP poisoning is an active attack that may be illegal without permission.

## FAQ

**Is sniffing illegal?**

Sniffing is legal if you own the network or have explicit permission from the network owner. Unauthorised sniffing is illegal and considered wiretapping or computer fraud in many jurisdictions.

**Can I sniff my own Wi-Fi traffic?**

Yes, you can sniff traffic on your own Wi-Fi network for educational or diagnostic purposes. However, on modern Wi-Fi, you may need to put your card into monitor mode and capture the handshake, as WPA2 encryption makes the packets unreadable without the password.

**What is the difference between Wireshark and tcpdump?**

Wireshark is a graphical tool with a user interface for point-and-click analysis. Tcpdump is a command-line tool that captures packets and prints them to the terminal or saves them to a file. Both capture the same packets, but Wireshark is easier for beginners.

**How does a switch stop sniffing?**

A switch maintains a table (CAM table) that maps MAC addresses to specific ports. When a packet arrives, the switch forwards it only to the port where the destination MAC address is connected. This prevents other ports from seeing the traffic, unlike a hub which sends it everywhere.

**What does promiscuous mode mean?**

Promiscuous mode is a setting on a network interface card that tells it to accept and process every packet it receives, not just packets addressed to its own MAC address. Without it, the OS discards packets meant for other devices before any application can see them.

**Can I sniff traffic on a different subnet?**

No, sniffing and ARP poisoning only work on the same local subnet (broadcast domain). Traffic between different subnets must pass through a router, and you cannot directly eavesdrop on that traffic unless the router is compromised or you can intercept at a higher level.

## Check your understanding

1. **What is the difference between passive sniffing and active sniffing?**

   Answer: Passive sniffing involves listening to traffic without sending any packets, and it works on hub-based networks. Active sniffing involves sending packets (like fake ARP replies) to redirect traffic, and it is required on switched networks.

2. **Which protocol is vulnerable to sniffing and sends passwords in plaintext?**

   Answer: Telnet is vulnerable because it transmits all data, including usernames and passwords, in unencrypted plaintext. Other examples include FTP and HTTP.

3. **What is the primary goal of ARP poisoning?**

   Answer: The goal is to become a man-in-the-middle by associating the attacker's MAC address with the IP address of a legitimate device (such as the gateway) so that traffic intended for that device is sent to the attacker instead.

4. **What mode must a network card be in to capture all traffic on a network segment?**

   Answer: The network card must be in promiscuous mode. This allows it to read every packet that passes through the interface, not just those addressed to its own MAC address.

5. **Why is HTTPS traffic considered immune to sniffing?**

   Answer: HTTPS traffic is not immune to capture; the packets can still be sniffed. However, the payload is encrypted, so the attacker cannot read the plaintext data without the decryption key.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/ec-ceh/sniffing