Packet Sniffing: Passive Capture on Switched Networks

Every packet that crosses a network is, for a moment, just electrical or radio signal that some device turns back into data. Packet sniffing is the practice of grabbing a copy of that data as it passes and reading it. A network engineer does it to debug a slow application. An attacker does it to harvest passwords, session tokens, and anything else sent in the clear. The tool is the same, a packet capture program like Wireshark or tcpdump; only the intent differs.

In its basic form sniffing is passive. The sniffer listens and copies, it does not inject or modify traffic. That is what makes it dangerous and hard to catch: a passive listener adds nothing to the wire for a defender to notice. On the ATT&CK matrix this is Network Sniffing (T1040). Whether an attacker can sniff your traffic at all comes down to one question: can they hear it? And the answer depends heavily on the kind of network you are on.

How a sniffer captures traffic

A normal network interface ignores frames that are not addressed to it. It reads the destination hardware address, sees the frame is for someone else, and drops it. Sniffing starts by turning that filtering off, putting the interface into promiscuous mode, so it keeps every frame it can hear rather than only its own.

Once the interface hands up everything it receives, the capture tool reassembles the frames into packets and the packets into streams, and decodes the protocols inside. If the contents are cleartext, the sniffer reads them directly: the HTTP request, the DNS query, the login sent over an unencrypted protocol. The whole technique rests on that one precondition, the interface being able to hear the traffic in the first place. Network design decides whether it can.

Shared versus switched networks

The history of sniffing is really the history of that precondition changing.

Old networks were built on a shared medium. Everything connected to a hub, and a hub is electrically dumb: any frame sent to it goes out every port. Every host physically received every other host's traffic and simply chose to ignore what was not theirs. Flip an interface into promiscuous mode and you heard the entire segment. Sniffing was effortless.

Switches broke that. A switch learns which hardware address lives on which port and forwards each frame only out the port where its destination lives. Your laptop, on a switched network, normally hears only its own traffic plus broadcasts. Promiscuous mode still captures everything the interface receives, but the switch is no longer sending you anyone else's frames. Passive sniffing on a switched network gets you your own traffic and little else.

Network type	What one host can hear	Sniffing effort	How an attacker widens the view
Shared (hub)	Every host's traffic on the segment	Trivial, purely passive	Nothing needed, it is already exposed
Switched	Its own traffic plus broadcasts	Limited without more	Active redirection or a physical tap
Wireless	Everything in radio range on the channel	Easy if unencrypted	Just be in range and on the channel

Turning passive into active

Because a switch will not simply hand an attacker everyone else's traffic, sniffing a switched network usually forces the attacker to take an active step to get into the path. That step is what makes the attack detectable, and it is where passive capture stops being passive.

• ARP spoofing. The attacker poisons the mapping between IP and hardware addresses so victims send their traffic to the attacker first, who then forwards it on. Now the attacker is in the path and can sniff, but the forged ARP messages are visible to defenses that watch for them.
• Rogue DHCP or gateway. By becoming the victim's gateway, the attacker routes the traffic through itself and captures it in transit.
• Port mirroring or a physical tap. With physical or administrative access, an attacker can mirror a switch port or splice a tap onto a cable, reintroducing shared-medium exposure by force.
• MAC flooding. Overwhelming a switch's address table can push some switches into a fail-open mode where they behave like a hub, flooding frames out every port.

The pattern is consistent: the switch pushed sniffing from a free passive act into something that requires an active, noisier move. Defenders get their opening at that active step.

These active steps rarely stand alone. Sniffing to harvest credentials is usually one stage of a longer operation, and the same actors reuse the ARP and DHCP tricks that get them into the path. Our Threat Groups directory maps who relies on network interception and how it fits into their broader intrusions, which helps you weigh a stray ARP anomaly against a pattern that matches a known campaign.

Why encryption is the control that scales

Every network-path defense has the same limit: it tries to control who can hear the traffic. Physical taps, wireless, and a clever active attack can all defeat that. The defense that does not depend on the path is encryption.

When traffic is encrypted end to end, a sniffer still captures the packets. It sees the addresses, the sizes, the timing, the metadata. What it cannot see is the payload, because without the keys the contents are noise. The capture succeeds and the value collapses. TLS, specified in RFC 8446, is what does this for most application traffic today, and NIST SP 800-52 gives the configuration guidance for deploying it well.

This is why the practical answer to sniffing is to assume the network is hostile and encrypt anyway. You do not have to win the argument about whether an attacker can get into the path, because if the payload is encrypted, getting into the path buys them metadata and nothing more.

That metadata is worth a moment of honesty. Encryption hides the payload, and a patient observer can still learn a surprising amount from the outside of the packets: which servers a host talks to, how often, at what times, and in what volume. Traffic-analysis work can sometimes infer the kind of activity from packet sizes and timing alone, even without reading a byte of content. This does not undo the value of encryption, which remains the single most important control against sniffing. It is a reminder that encrypting the payload is the floor of what strong transport gives you, and that sensitive patterns of who-talks-to-whom may still need padding, tunnelling, or aggregation to protect.

How to defend against packet sniffing

1. Encrypt everything in transit. Use TLS for application traffic and retire cleartext protocols. This is the control that holds even when every network-layer defense fails, so treat it as the foundation.
2. Configure TLS properly. Modern versions, strong cipher suites, valid certificates, and no silent downgrade. A misconfigured or bypassable TLS setup gives back what encryption was supposed to protect.
3. Defend the switched fabric. Enable DHCP snooping and Dynamic ARP Inspection so the active attacks that reposition an attacker into the path, ARP spoofing and rogue DHCP, get blocked at the switch.
4. Control MAC tables and ports. Use port security to limit addresses per port and disable unused ports, which blunts MAC flooding and unauthorized taps.
5. Secure wireless at the link layer. Use current wireless encryption and authentication so radio range does not equal readable traffic, and keep guest and internal networks separated.
6. Watch for the active tells. You cannot detect passive listening directly, but you can detect the ARP anomalies, unexpected DHCP servers, and address-table churn that an attacker needs in order to sniff a switched network. Alert on those.

What a capture actually contains

It helps to picture what a sniffer sees, layer by layer, because the exposure depends on how far up the stack the cleartext reaches.

At the bottom is the link layer, the Ethernet or wifi frame. A capture always shows the hardware addresses and the frame structure, because the interface has to read them to receive anything at all. Above that is the network layer, where the source and destination IP addresses live. These are visible in almost every capture, encrypted payload or not, because routers need them to move the packet. Above that is the transport layer, showing ports and sequence numbers, which reveal which service is being contacted and let the tool reassemble a stream. At the top is the application layer, where the actual content lives: the web request, the email body, the login.

The application layer is where encryption decides everything. If the application data is cleartext, the sniffer reads it in full. A plaintext login shows the username and password directly. An unencrypted web session shows the pages, the form fields, and any session cookie, and that cookie is often enough to impersonate the user without ever knowing the password. If the application data is encrypted, the sniffer still sees every layer beneath it, so it learns who is talking to whom and how much, and it sees nothing of what was said.

The exposure of a given service comes down to whether it runs a cleartext protocol or an encrypted one. The pattern is consistent across the common services.

Exposure	Cleartext protocol	Encrypted replacement
Web browsing	HTTP	HTTPS with TLS
Email retrieval	POP3 or IMAP in the clear	The same over TLS
File transfer	FTP	SFTP or FTPS
Remote shell	Telnet	SSH
Name lookups	DNS in the clear	DNS over TLS or HTTPS

Every row on the left hands a sniffer readable content. Every row on the right hands it metadata and noise. Retiring the left column is the same project as defeating sniffing.

This layered view explains why session tokens and cookies are such prized sniffing targets. A password may be sent once at login, but a session cookie rides along with every request for the life of the session. A sniffer that captures one such cookie on an unencrypted connection can replay it and take over the session, which is why cleartext session handling is dangerous even when the initial login was protected.

A worked example of the switched-network problem

Picture an attacker who has compromised one ordinary laptop on a switched office network and wants to read a colleague's traffic. Passive capture on that laptop yields only its own frames and broadcasts, because the switch forwards each frame only to the port where its destination lives. The attacker cannot see the colleague's login by listening quietly.

To widen the view, the attacker poisons the address resolution mapping. They send forged messages telling the colleague's machine that the attacker's laptop is the gateway, and telling the gateway that the attacker's laptop is the colleague. Now both sides send their traffic to the attacker first, who forwards it on so the conversation still works. The attacker sits in the middle and captures everything that passes. The capture itself is passive once the position is held, and the step that established the position is loud. The forged mapping messages are visible to any defense watching for address resolution anomalies, and the sudden change in which port owns which address is exactly the kind of tell a monitored switch surfaces.

Detection signals

You cannot see passive capture on the wire, so detection targets the active steps that make it possible on a switched or routed network.

• Address resolution anomalies. One hardware address suddenly claiming an IP that belongs to another host, or the gateway's IP mapping to an unexpected hardware address, is the fingerprint of address-mapping poisoning. Switches with dynamic inspection can flag or block these outright.
• Unexpected DHCP offers. A DHCP server responding from a port or host that should not be offering addresses points to a rogue server trying to become the gateway for its victims.
• Address-table churn. A switch whose forwarding table is filling with a flood of new hardware addresses may be under a flooding attack meant to push it into fail-open behaviour.
• Duplicate address complaints. Hosts reporting that their IP is in use elsewhere can be a side effect of a poisoning attack that briefly claims their address.
• Gateway mismatches. A host whose default gateway maps to a hardware address that keeps changing, or that differs from its neighbours, is a candidate for interception.
• Interfaces in promiscuous mode. On managed endpoints, an interface that has been placed into promiscuous mode without an operational reason is worth investigating, because ordinary hosts have no need for it.

None of these prove a capture is underway, and each has benign causes. Together they narrow the search to the machines and moments where interception is plausible, which is the best a defender can do against a technique whose core act leaves no trace.

How sniffing evolved

The trajectory of packet sniffing tracks the evolution of the network itself. In the shared-medium era, every host heard every frame, and sniffing was a matter of switching on promiscuous mode. The move to switched fabrics removed that free visibility and forced attackers into active repositioning, which in turn created the detectable signals defenders now rely on.

Encryption changed the value of a capture rather than the ability to make one. As cleartext protocols gave way to encrypted transport for web, mail, and remote access, the payload a sniffer could read shrank toward metadata. Wireless reintroduced shared-medium exposure at the radio layer, which is why link-layer wireless encryption became a baseline rather than an option. The net effect is that sniffing still works everywhere the medium can be heard, and it yields far less than it once did wherever the payload is encrypted.

Common misconceptions

The first misconception is that switches make a network safe from sniffing. A switch limits passive capture to your own traffic, and it does raise the bar. It does nothing once an attacker has repositioned into the path through poisoning, a rogue gateway, or a physical tap. A switch is a hurdle, and encryption is the wall.

The second misconception is that HTTPS on the login page is enough. If the session that follows runs in cleartext, a sniffer captures the session cookie and impersonates the user, and the protected login bought little. Encryption has to cover the whole session, and every request within it, to be worth anything against a sniffer.

The third misconception is that a virtual private network solves sniffing everywhere. A VPN encrypts traffic between the endpoint and the VPN gateway, which protects it across the untrusted segment in between. Beyond the gateway, where the traffic exits toward its destination, it is only as protected as its own transport encryption. A VPN moves the trust boundary. It does not make cleartext safe past the exit point.

The fourth misconception is that sniffing needs special access. On open wireless, anyone in radio range with a capable interface can capture frames, no compromise required. The barrier there is proximity and a receiver, not privilege.

Frequently asked questions

Is packet sniffing illegal?

The tools are legitimate and widely used for network debugging, performance analysis, and security monitoring. Capturing traffic you are not authorised to capture is what crosses the line. The same program is a diagnostic in the hands of an engineer and an interception tool in the hands of an attacker. Intent and authorisation separate the two.

Can a firewall stop sniffing?

A firewall controls which traffic is allowed to flow, and it does not stop an attacker who is already positioned to hear traffic that is flowing. The controls that matter against sniffing are encryption for the payload and switch-level protections such as dynamic address inspection and DHCP snooping for the positioning attacks.

Does encryption make sniffing pointless?

Encryption removes the payload, which is usually the attacker's goal, so it defeats the most valuable outcome of a capture. It does not hide the metadata. A sniffer still learns the addresses, the volumes, and the timing, and traffic analysis can infer a surprising amount from those alone. Encryption is the essential control, and sensitive traffic patterns may still need padding or tunnelling on top of it.

How do I know if someone is sniffing my network?

You generally cannot detect passive listening directly. You can detect the active steps that make sniffing possible on a switched network: address resolution anomalies, rogue DHCP servers, address-table flooding, and gateway mismatches. Monitoring for those is the practical form of sniffing detection.

Is wireless more exposed than wired?

Wireless behaves like the old shared-medium world, because every device in radio range on the channel physically receives the frames. Without link-layer encryption, anyone nearby can capture them without touching your infrastructure. A switched wired network limits passive capture in a way that radio does not, which is why wireless encryption is treated as mandatory.

What is the single most effective defense?

Encrypt everything in transit. It is the one control that holds even when every network-layer protection fails, because a captured packet without the keys is noise. Harden the switched fabric and secure the radio as well, and treat encryption as the foundation the rest sits on.

Packet sniffing is one of the oldest techniques on the network and it remains in play. What has changed is where it works. Switches took away the free passive capture of the hub era and forced attackers into active, detectable steps to get back into the path. Wireless and physical taps quietly hand some of that exposure back. The one defense that does not care which of these an attacker manages is encryption: capture the packets all you like, without the keys they are noise. Encrypt in transit, harden the switched fabric, secure the radio, and watch for the active setup, and sniffing loses almost everything it was after.

Related guides

• Man-in-the-Middle Attacks Explained
• ARP Spoofing Explained
• How HTTPS Works
• Network Security Fundamentals