🕵️ 03-01: Packet Sniffing Basics¶

📌 What Is Packet Sniffing?¶

Packet sniffing is the act of capturing network traffic as it travels across a wire (or through the air) so it can be inspected.

👉 A sniffer (also called a packet analyzer or protocol analyzer) is any tool or program that:

Grabs a copy of every frame that arrives at a network interface
Decodes the headers (Ethernet, IP, TCP/UDP, application layer)
Displays or logs the contents for a human (or another program) to read

💡 Sniffing is completely passive — the sniffer doesn't inject or alter anything, it just listens. That passivity is exactly what makes it dangerous: a victim usually has no way to know that a sniffer is running unless they specifically look for one.

🎫 Promiscuous Mode vs. Normal NIC Mode¶

Every NIC (Network Interface Card) has a MAC address, and under normal operation it is deliberately lazy:

Mode	Behavior
Normal mode	The NIC only hands the operating system frames addressed to its own MAC address (or broadcast/multicast frames it has subscribed to). Everything else is discarded in hardware.
Promiscuous mode	The NIC hands every frame it sees to the operating system, regardless of destination MAC address.

👉 Sniffing tools (Wireshark, tcpdump, Scapy) put the NIC into promiscuous mode so they can see traffic that isn't addressed to the local machine.

💡 On Wi-Fi, there's an even more powerful cousin called monitor mode, which captures raw 802.11 frames (including management/control frames) without needing to be associated with an access point at all.

⚠️ Enabling promiscuous/monitor mode almost always requires administrator/root privileges — this is one of the few built-in speed bumps against casual sniffing.

🧠 Why Sniffing Works Trivially on a Hub¶

To understand why sniffing is such a big deal, it helps to compare two pieces of networking hardware that look similar but behave very differently.

Hubs: A Shared Broadcast Medium¶

A hub is a "dumb" Layer-1 device. When it receives an electrical signal (a frame) on one port, it simply repeats that signal out every other port, with no understanding of addressing at all.

        ┌─────────┐
 PC-A ──┤         ├── PC-B
        │   HUB   │
 PC-C ──┤         ├── PC-D
        └─────────┘

PC-A sends a frame to PC-B →
the hub blasts it out to PC-B, PC-C, and PC-D too.

👉 On a hub, every device on the segment physically receives every frame, whether it's addressed to them or not. Normally the NIC just throws away anything not addressed to it — but flip on promiscuous mode, and an attacker plugged into any port on the hub can read all the traffic of everyone on that hub. No trickery required.

Switches: A Point-to-Point Illusion¶

A switch is smarter. It learns which MAC address lives behind which port (by building a MAC address table from observed traffic) and then forwards each frame only out the port where the destination actually lives.

        ┌─────────┐
 PC-A ──┤         ├── PC-B
        │ SWITCH  │
 PC-C ──┤         ├── PC-D
        └─────────┘

PC-A sends a frame to PC-B →
the switch looks up its MAC table and sends the frame
ONLY out the port connected to PC-B.
PC-C and PC-D never see it.

👉 This means simply plugging in and flipping on promiscuous mode does not let an attacker see other people's traffic on a switched network — the frames physically never arrive at the attacker's port in the first place (with the exception of broadcast/multicast traffic, like ARP requests, which switches still flood to every port).

💡 This is a common beginner misconception: "switches are secure against sniffing." They raise the bar, but they don't eliminate the threat — see the forward reference below.

🔀 So How Do Attackers Sniff on a Switched Network?¶

Switches were never designed as a security control — they were designed for performance (avoiding unnecessary collisions and traffic). An attacker with access to the LAN has several ways to defeat this isolation, the most common being:

ARP spoofing / ARP cache poisoning — trick the switch's neighboring hosts into sending their traffic through the attacker by lying about MAC-to-IP mappings. This is covered in depth in 03-04: ARP Spoofing Attacks, after we cover how ARP itself works in 03-03: ARP Protocol Recap.
MAC flooding — overwhelm the switch's MAC address table until it "fails open" and starts behaving like a hub (broadcasting everything).
Port mirroring / SPAN ports — a legitimate feature (not an attack) where a network administrator configures the switch to copy all traffic from one or more ports to a monitoring port, for IDS or troubleshooting use.
Physical tap — an inline hardware device inserted directly on the cable that copies signals to a monitoring port.

✅ Legitimate Uses of Sniffing¶

Sniffing itself is a neutral capability — it's a foundational tool for network professionals, not just attackers:

Use case	Description
Troubleshooting	Diagnosing why an application is slow, why a connection is dropping, or why DNS isn't resolving, by watching the actual packets.
IDS/IPS (Intrusion Detection/Prevention Systems)	Security appliances sniff traffic on a SPAN port to look for attack signatures or anomalous behavior.
Network monitoring & capacity planning	Understanding what protocols and how much bandwidth are actually being used.
Protocol development & debugging	Engineers building or fixing network software need to see the exact bytes going over the wire.
Security research/pentesting	With authorization, sniffing traffic reveals what an attacker on the same network segment could see.

🚨 Malicious Uses of Sniffing¶

The same technique becomes an attack when used without authorization:

Credential theft — capturing plaintext usernames/passwords from unencrypted protocols (Telnet, FTP, HTTP, old versions of POP3/IMAP).
Session token / cookie theft — stealing an authentication token to hijack a logged-in web session.
Reconnaissance — passively mapping out hosts, services, and internal network structure before a bigger attack.
Data exfiltration — capturing sensitive data (documents, PII, chat messages) sent unencrypted.

💡 The single biggest defense against sniffing isn't hiding the traffic — it's encrypting it. Even if an attacker captures every byte, TLS/HTTPS, SSH, and VPN tunnels make the captured payload useless without the decryption key. Module 09 covers this in depth.

🧪 A Quick Mental Model¶

Normal NIC:      "Is this frame addressed to me? No → drop it."
Promiscuous NIC: "Give me every frame, addressed to me or not."

Hub:             Every frame reaches every port → sniffing trivial.
Switch:          Frames only reach the intended port → sniffing needs
                 extra tricks (ARP spoofing, MAC flooding, port mirroring).

📌 Key Takeaways¶

Packet sniffing captures and inspects network traffic as it travels; it is passive by nature.
A NIC in normal mode only accepts frames addressed to it; promiscuous mode accepts everything, and is required for sniffing.
On a hub, every device physically receives every frame — sniffing is trivial once promiscuous mode is on.
On a switch, frames are forwarded only to their destination port, so plain promiscuous mode isn't enough — the attacker needs ARP spoofing, MAC flooding, or physical access to a mirrored/tapped port.
Sniffing has essential legitimate uses: troubleshooting, IDS/IPS, monitoring, and protocol development.
Malicious sniffing enables credential theft, session hijacking, reconnaissance, and data exfiltration.
Encryption (TLS, SSH, VPNs) is the strongest defense — it doesn't stop sniffing, but it makes captured data unreadable.
The next lesson, 03-02: Sniffing Tools (Scapy/tcpdump), tours the actual tools used to sniff traffic in practice.