24. Traffic Sniffing and Analysis
24.1 What Sniffing Is
In short: Sniffing means capturing the packets travelling on a network so you can read them.
Sniffing means capturing the packets travelling on a network so you can read them. A network card normally ignores packets not addressed to it; promiscuous mode tells it to capture everything it sees.
- On an old hub, every packet reached every machine, so sniffing was easy.
- On a modern switch, traffic goes only to the correct port, so an attacker sees only their own traffic – unless they use tricks like ARP spoofing (24.5) or a monitor/SPAN port.
- On Wi-Fi, packets travel through the air, so anyone in range can capture them (encryption is what protects you).
Defensively, sniffing is also how you analyse problems and detect attacks – it is a core SOC and troubleshooting skill, not only an attacker tool.
Ravindra Bagale's Tip
"I'm on the network, so I can see all the traffic" is a misconception – because of the switch, you only see your own traffic and broadcast traffic. To see the rest you need ARP spoofing, and that can be detected. Once you understand this, you can think like both the attacker and the defender.
Ravindra Bagale's Tip – मराठी
"मी network वर आहे म्हणजे सगळे traffic दिसेल" हा गैरसमज आहे – switch मुळे तुम्हाला फक्त तुमचे आणि broadcast traffic दिसते. बाकीचे बघायला ARP spoofing लागते, आणि ते detect होते. हे समजले की तुम्ही attacker आणि defender दोघांचाही विचार करू शकता.
Ravindra Bagale's Tip – हिंदी
"मैं network पर हूँ तो सारा traffic दिखेगा" यह गलतफ़हमी है – switch की वजह से आपको सिर्फ़ अपना और broadcast traffic दिखता है. बाकी देखने के लिए ARP spoofing चाहिए, और वह detect हो जाता है. यह समझ गए तो आप attacker और defender दोनों की तरह सोच सकते हो.
Practice task
In your notes, explain in two lines the difference between a hub and a switch for sniffing, and name one reason capturing on Wi-Fi is different from capturing on a wired switch.