> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/red-team/sniffing.md).

# Sniffing

**Sniffing** is the process of capturing and analyzing network traffic to inspect the data being transmitted between devices. It can be either **legitimate** (for monitoring and troubleshooting) or **malicious** (to intercept sensitive data like usernames, passwords, emails, etc.).

***

### ✅ Legitimate Uses of Sniffing

* Network diagnostics and troubleshooting
* Performance monitoring
* Debugging communication issues
* Detecting unauthorized network access
* Compliance and auditing

***

### ❌ Malicious Uses of Sniffing

* Capturing login credentials (e.g., Telnet, FTP)
* Session hijacking
* Monitoring user activities (web, chat, email)
* Extracting confidential files or database queries
* Target reconnaissance in penetration testing or cyberattacks

***

### 📊 Sniffing in Encrypted vs. Unencrypted Protocols

| Protocol        | Encrypted | Sniffing Risk                           |
| --------------- | --------- | --------------------------------------- |
| Telnet          | No        | High (Cleartext passwords)              |
| FTP             | No        | High (User/pass in plain text)          |
| HTTP            | No        | Moderate (Web data exposed)             |
| DNS             | No        | Medium (Domain queries visible)         |
| HTTPS (TLS/SSL) | Yes       | Low (Unless MITM, certificate spoofing) |
| SMTPS / IMAPS   | Yes       | Low (Metadata may still leak)           |

***

### 🎯 Common Targets for Sniffing

* **DNS Queries** → Reveal browsing activity
* **Email Metadata** → Exposes sender/receiver
* **Chat Sessions (IRC/XMPP)** → If unencrypted, content visible
* **Router/Switch Configs** → Often managed over insecure channels (e.g., SNMP, Telnet)
* **VoIP Calls** → Interceptable if not encrypted

***

### 🔄 Types of Sniffing

#### 1. **Passive Sniffing**

* Listens silently to traffic.
* No packet injection.
* Works well on **hub-based networks** or **SPAN (mirror) ports**.
* Examples:
  * Eavesdropping
  * Traffic logging

#### 2. **Active Sniffing**

* Interacts with the network to capture more traffic.
* Used in switched networks.
* Enables MITM attacks.
* Can **modify or inject packets**.

***

### 🔥 Active Sniffing Attacks

| Attack                      | Description                                    | Tools                             |
| --------------------------- | ---------------------------------------------- | --------------------------------- |
| **DHCP Starvation**         | Exhausts IP pool by flooding requests          | `yersinia`, custom Python scripts |
| **MAC Flooding**            | Overwhelms switch MAC table to force broadcast | `macof`                           |
| **ARP Spoofing/Poisoning**  | Impersonates a gateway or host                 | `ettercap`, `arpspoof`            |
| **ICMP Redirect**           | Fools host to route through attacker           | Custom ICMP injectors             |
| **Turning Switch into Hub** | MAC flooding makes switch act like a hub       | `macof`, `dsniff` suite           |

***

### 🧪 Sniffing Tools (Packet Analyzers)

| Tool          | Description                                                 |
| ------------- | ----------------------------------------------------------- |
| **Wireshark** | GUI-based analyzer; supports real-time and offline analysis |
| **tcpdump**   | Command-line packet capture tool                            |
| **windump**   | Windows version of tcpdump                                  |
| **OmniPeek**  | Commercial, advanced analyzer for performance               |
| **Ettercap**  | ARP spoofing and packet capture (MITM)                      |
| **Yersinia**  | Network protocol attacker (DHCP, STP, etc.)                 |

***

### 🧷 Sniffing in Switched Networks

#### Layer 2 Attacks

* Switch table flooding
* MAC spoofing
* ARP cache poisoning

#### Layer 3 Attacks

* DNS spoofing
* ICMP redirect attacks
* Rogue DHCP servers
* IP source routing manipulation