What Is a Sniffer?
A sniffer is an application or device that captures ("sniffs") network traffic as it moves across the wire or through the air. It's a technology used to steal or observe information — email passwords, web passwords, FTP credentials, email contents, and transferred files can all be exposed.
Network sniffing (eavesdropping)
A type of attack where the attacker captures packets across a wire or wireless connection. The main goal: capture unencrypted credentials traveling across the network.
Why it matters
Anything sent in plaintext — old FTP, HTTP, Telnet — is fair game for a sniffer. Encryption is the #1 defense against this entire chapter's worth of attacks.
Types of Sniffing
Happens on a hub, where traffic is broadcast to all ports. The attacker just listens — no packets are sent.
- Works only in a common collision domain (unswitched/unbridged segment)
- Hubs are outdated; most networks use switches now
- Methods: compromising physical security (plug in a laptop), or a Trojan with built-in sniffing capability
Used on switched networks where traffic isn't broadcast to everyone. The attacker actively injects packets to manipulate traffic flow.
- ARP spoofing/poisoning — redirect traffic through the attacker
- MAC flooding — overflow the CAM table, forcing hub-like flooding behavior
Mnemonic — Hub Whispers, Switch Fights
"HUB = HUSH (Hub Uses Silent Hearing)" vs "SWITCH = STRIKE (Sends Traffic, Requires Interference to Keep Eavesdropping)". Passive sniffing = quiet hub listening. Active sniffing = loud switch attacking (ARP/MAC games).
Detectability
Passive sniffing is very hard to detect — no extra traffic generated (only clue: NIC in promiscuous mode, or odd CPU/disk usage). Active sniffing is easier to detect — IDS can spot unusual ARP traffic, MAC address flapping, and duplicate IP addresses.
Switch Basics & the CAM Table
Every switch keeps a Content Addressable Memory (CAM) table — a fixed-size table mapping MAC addresses to switch ports (plus VLAN info). When a frame arrives, the switch learns the source MAC and updates the table. If a destination MAC isn't found, the switch floods the frame to all ports in that VLAN.
The CAM table has a limited size. If you can fill it up with junk entries, the switch can no longer learn new legitimate MACs and starts flooding everything — turning a switch into a hub. That's exactly what MAC flooding does.
ARP Protocol Basics
ARP (Address Resolution Protocol) resolves IP addresses to MAC addresses, bridging the Network Layer (IP) and Data Link Layer (MAC), within a LAN.
Check ARP Cache
Host checks if it already has a mapping for the target IP.
ARP Request (broadcast)
"Who has IP X.X.X.X?" sent to everyone on the LAN.
ARP Reply (unicast)
Target host replies: "IP X.X.X.X is at MAC XX:XX:XX:XX:XX:XX."
Cache the Mapping
Stored in the ARP cache for a duration that varies by OS.
The core weakness
ARP is a trust-based protocol — devices accept ARP replies even without sending a request, and there's no way to verify an IP–MAC mapping is legitimate. This is exactly why ARP poisoning works.
MAC Flooding Attack
A Layer 2 attack targeting a switch's CAM table. The attacker floods the switch with frames using random, spoofed source MAC addresses, filling the table until legitimate entries get evicted.
Once in "hub mode," the attacker can passively sniff traffic meant for other devices.
Defense: Port Security
Port security restricts a switch port to a limited set of authorized MAC addresses.
Violation Triggers
- Max number of secure MACs reached on a port
- An unrecognized MAC tries to access the port
Configuration Methods
- Manually configure secure MACs (
switchport port-security mac-address) - Dynamically learn from connected devices
- Hybrid: some manual, rest dynamically learned
Benefits of Port Security
Limits MAC flooding, locks ports to authorized devices only, and can send SNMP traps for monitoring/alerts.
ARP Poisoning / ARP Spoofing
The attacker sends forged ARP messages to manipulate the ARP tables (caches) of other devices. Goal: associate the attacker's MAC address with the IP of a legitimate device (often the default gateway).
Reconnaissance
Identify the IP addresses of the target victim and the default gateway.
The Poisoning
Send forged ARP replies: tell the victim "I am the gateway"; tell the gateway "I am the victim" — both point to the attacker's MAC, sent continuously.
The Redirection
Both sides update their ARP caches with false mappings; all traffic between them now flows through the attacker.
The Attack
Sniff (steal data), Modify (alter packets in transit), or Block (drop traffic → DoS).
Mnemonic — R.P.R.A
"Real Pirates Rob Anchors" = Reconnaissance → Poisoning → Redirection → Attack (sniff/modify/block). ARP poisoning is the pirate hijacking the ship's route so all cargo passes through them first.
| Result of Successful ARP Poisoning |
|---|
| Man-in-the-Middle attack (intercept and steal data) |
| Launch Denial-of-Service attacks |
| Perform session hijacking |
ARP Spoofing Prevention
1. Encryption (mitigation, not prevention)
VPN encrypts traffic so intercepted data is unreadable. Doesn't stop the spoofing itself, only its impact.
2. Static ARP Entries
Manually bind IP↔MAC pairs so devices reject fake replies. Not scalable for large networks.
3. Packet Filtering & Monitoring
IDS/IPS detects conflicting IP–MAC mappings and suspicious ARP traffic, blocking malicious packets.
4. Dynamic ARP Inspection (DAI)
Validates ARP packets against the DHCP snooping binding table; drops invalid/spoofed packets. One of the most effective defenses.
5. Security / Penetration Testing
Perform controlled ARP spoofing tests to evaluate defenses and find weaknesses.
Monitor the network for a single MAC address mapped to multiple IP addresses, or use Wireshark to spot unusual ARP traffic. Display the ARP table via the command line (Windows/Linux). If two different IPs share the same MAC, an ARP attack is likely underway — e.g. if 192.168.5.1 (the router) shares a MAC with another IP, the attacker's IP is probably that other address (e.g. 192.168.5.202).
Sniffing Tools & Countermeasures
Wireshark
Industry-standard packet capture & analysis tool.
Tcpdump / Windump
Command-line packet sniffers (Linux/Windows).
Omnipeek
Commercial network analysis tool.
Dsniff
Suite of tools for network auditing/penetration testing including sniffing.
EtherApe
Graphical network monitor.
MSN Sniffer
Captures MSN messenger traffic.
NetWitness NextGen
Network forensics/analysis platform.
Throwing Star LAN Tap
Physical passive network tap device.
Sniffing Countermeasures
Encryption (renders captured data useless), Static ARP entries (blocks spoofed replies), Port security (limits MAC flooding).
Session Hijacking
Session hijacking is when an attacker takes over an active, valid TCP session between a client and a server.
How it works
- Authentication typically happens only once, at the start of a session
- The server then relies on a session ID / cookie to maintain the connection
- The attacker captures this session ID (via sniffing or MITM)
- The attacker reuses it to impersonate the legitimate user
| Impact of Session Hijacking |
|---|
| Unauthorized access to systems/accounts |
| Identity theft |
| Data theft or manipulation |
| Fraudulent actions |
Three Ways to Obtain a Session ID
Stealing
Physical access to session ID files/memory, or sniffing traffic with tools like Wireshark / SteelCentral Packet Analyzer.
Guessing
Observing session variables to guess IDs — only effective when the server uses weak/flawed session-ID generation.
Brute Forcing
Trying all possible permutations. A DSL attacker can generate up to 1,000 session IDs/second — most useful when the ID algorithm is non-random.
Mnemonic — S.G.B
"Sneaky Guys Brute-force" = Steal, Guess, Brute-force — the three ways attackers acquire a session ID.
Identifying an Active Session
Hijacking builds on sniffing but goes further — the attacker must find and take control of an already-authenticated session. This is hard due to network segmentation, switched networks, and encryption.
Sequence Number Facts
- TCP sequence numbers are 32-bit values → over 4 billion combinations
- They ensure packets are ordered correctly and reassembled properly at the destination
To hijack a session, the attacker must predict or obtain valid sequence numbers.
3-Way Handshake & ISN Prediction
Each side selects an Initial Sequence Number (ISN). Modern systems use pseudo-random ISNs, but if they're predictable, an attacker can forge packets, spoof an IP, establish a connection, and potentially hijack the session.
Spoofing vs Hijacking
IP spoofing forges a source address to impersonate a host before a session exists. Session hijacking takes over a session that is already active. Hijacking is the more powerful, harder-to-detect version.
Session Hijacking Tools
Ettercap
Multiplatform tool for MITM attacks, ARP spoofing, and session hijacking.
Hunt
Works on Ethernet-based networks in passive and active modes.
Juggernaut
Linux network sniffer with the ability to hijack TCP sessions.
Paros HTTP Hijacker
Java HTTP/HTTPS proxy that intercepts and edits HTTP messages in real time.
IP-Watcher
Commercial-grade tool for session hijacking and connection monitoring.
T-sight
Commercial tool that can hijack TCP sessions on a network.
Thwarting Session Hijacking
Be proactive with encryption; configure routers to block spoofed traffic from outside the protected network; use an intrusion detection system (IDS).
Denial of Service (DoS) Attacks
A DoS attack prevents authorized users from accessing a computer or network by targeting network bandwidth or connectivity.
Overflow the network with high traffic volume using existing resources, depriving legitimate users of bandwidth.
Overflow a computer with a massive number of connection requests, exhausting OS resources so it can't process legitimate requests.
DoS Attack Techniques (7 kinds)
Bandwidth Attacks
Flood the network pipe with volume until it's saturated.
Service Request Floods
Flood a service with repeated legitimate-looking requests to exhaust it.
ICMP Flood Attack
Two variants — Smurf attack and ping flood (details below).
SYN Flooding
Sends a flood of TCP SYN packets, never completing the handshake, exhausting connection tables.
Peer-to-Peer Attacks
Exploits P2P clients/servers to redirect huge numbers of clients toward a victim.
Application-Level Flood Attacks
Targets application layer resources/logic rather than raw bandwidth.
ICMP Flood — Two Variants
Attacker sends traffic to a network's broadcast address with the victim's IP spoofed as the source. Every host on that network replies — flooding the victim, not the attacker.
Simply sends a huge number of ping packets directly at the victim to overwhelm it. Very simple, brute-force.
Mnemonic — B.S.I.S.P.A (7 DoS Techniques)
"Big Sharks Ignore Small Prey, Always" = Bandwidth attacks, Service request floods, ICMP flood (Smurf/ping), SYN flooding, Peer-to-peer attacks, Application-level floods. Seven ways to drown a target in traffic.
DDoS Attacks & Botnets
A Distributed Denial-of-Service (DDoS) attack uses a multitude of compromised systems to attack a single target at once, causing denial of service for that system's legitimate users.
Botnet
Bots are software applications that run automated tasks over the internet — normally benign things like web spidering or search indexing. A botnet is a huge network of compromised systems an attacker hijacks to launch DoS/DDoS attacks at scale.
One attacker, one (or few) source machines → one target.
One attacker, thousands of compromised bot machines (a botnet) → one target. Much harder to block since traffic comes from everywhere.
Exam Tips & Tricks
Passive = hub, Active = switch
Passive sniffing needs a common collision domain (hub). Active sniffing (ARP spoofing/MAC flooding) is required to sniff on switched networks.
ARP has NO authentication
This single fact is the root cause of ARP poisoning — memorize it, it's tested directly.
DAI is the strongest ARP defense
Dynamic ARP Inspection validates against DHCP snooping bindings — called out as "one of the most effective network-level defenses."
Smurf vs Ping Flood
Smurf = spoofed broadcast address abuse (amplification). Ping flood = brute-force direct flood. Don't mix them up.
TCP sequence numbers are 32-bit
Over 4 billion combinations — session hijacking requires predicting/obtaining these to forge packets.
DDoS = botnet-powered DoS
DDoS is DoS at scale using many compromised bots — that's the entire definitional difference tested.
Quick Reference — Everything at a Glance
| Topic | Key Point |
|---|---|
| Sniffer | Captures network traffic to steal/observe unencrypted info |
| Passive sniffing | Hub-based, only listens, hard to detect, needs common collision domain |
| Active sniffing | Switch-based, injects packets (ARP spoofing/MAC flooding), easier to detect |
| CAM table | Maps MAC addresses to switch ports + VLAN; fixed size |
| MAC flooding | Overflows CAM table with fake MACs → switch floods like a hub |
| Port security | Restricts a port to authorized MAC addresses; defends against MAC flooding |
| ARP | Resolves IP→MAC, stateless, no authentication, local scope only |
| ARP poisoning | Forged ARP replies redirect traffic through attacker (recon→poison→redirect→attack) |
| ARP poisoning results | MITM, DoS, session hijacking |
| ARP prevention | Encryption (mitigation), static ARP entries, packet filtering/IDS, Dynamic ARP Inspection (DAI), pen testing |
| Sniffing tools | Wireshark, Tcpdump, Windump, Omnipeek, Dsniff, EtherApe, MSN Sniffer, NetWitness NextGen, Throwing Star LAN Tap |
| Sniffing countermeasures | Encryption, static ARP entries, port security |
| Session hijacking | Taking over an active TCP session using a stolen/guessed/brute-forced session ID |
| Ways to get session ID | Stealing, guessing, brute forcing (up to 1,000/sec via DSL) |
| TCP sequence numbers | 32-bit, 4+ billion combos, ensure order + reassembly |
| 3-way handshake | SYN → SYN/ACK → ACK; ISN prediction enables hijacking if predictable |
| Session hijacking tools | Ettercap, Hunt, Juggernaut, Paros HTTP Hijacker, IP-Watcher, T-sight |
| Thwarting hijacking | Encryption, block spoofed traffic at routers, use IDS |
| DoS attack | Prevents authorized access by exhausting bandwidth or connectivity |
| DoS techniques (7) | Bandwidth attacks, service request floods, ICMP flood, SYN flooding, P2P attacks, application-level floods |
| Smurf attack | Spoofed broadcast traffic — entire network replies to the victim |
| Ping flood | Simple direct flood of ping packets at the victim |
| DDoS | Many compromised systems (botnet) attack a single target simultaneously |
| Botnet | Huge network of compromised machines used to launch DoS/DDoS at scale |