Packet sniffing is the capture and inspection of network packets as they travel across a wired or wireless network. Administrators use packet analyzers to troubleshoot connections, investigate incidents, and verify how an application communicates. An attacker who gains the same visibility may use it for eavesdropping or reconnaissance.
What a packet sniffer records
A capture can contain source and destination addresses, ports, protocol headers, timing, packet sizes, and application data. The exact contents depend on where the capture occurs and whether the traffic is encrypted. NIST defines a packet sniffer as software that observes and records network traffic.
HTTPS, SSH, and a properly configured VPN encrypt the payload, so a passive observer should not see passwords or page contents. Some metadata can remain visible, such as IP addresses, connection timing, and often DNS requests. Plain HTTP, FTP, Telnet, and other unencrypted protocols may expose credentials and content directly.
How an attacker gets access to traffic
- Monitoring an open or poorly secured Wi-Fi network.
- Compromising a router, access point, endpoint, or network management account.
- Abusing a switch mirror port or a capture tool left on a system.
- Using ARP spoofing or a rogue access point to place traffic in the attacker's path. This becomes an active man-in-the-middle attack, not merely passive sniffing.
Can you detect packet sniffing?
Passive sniffing may create no visible symptom because it does not need to alter traffic. Certificate warnings, an unexpected proxy, changed DNS settings, duplicate gateway addresses, or a new root certificate can instead indicate interception. On managed networks, review switch configuration, privileged tools, endpoint processes, and unusual ARP or DHCP activity.
How to protect network traffic
- Use HTTPS and other modern encrypted protocols; retire services that send credentials in plaintext.
- Use WPA2 or WPA3 with a strong password and keep router firmware current.
- Avoid sensitive activity on unknown Wi-Fi, or use a trusted VPN.
- Do not ignore certificate warnings or install an unknown root certificate.
- Segment sensitive systems and restrict access to switch mirror ports and packet-capture tools.
- Protect administrator accounts with MFA and monitor configuration changes.
Packet captures can themselves contain credentials, personal data, and confidential files. Capture only with authorization, limit the collection to what is needed, encrypt stored capture files, and delete them according to the organization's retention policy.