24. Traffic Sniffing and Analysis
24.1 What Sniffing Is
Sniffing means capturing the packets travelling on a network so you can read them. A network card normally ignores packets not addressed to it; promiscuous mode tells it to capture everything it sees.
- On an old hub, every packet reached every machine, so sniffing was easy.
- On a modern switch, traffic goes only to the correct port, so an attacker sees only their own traffic – unless they use tricks like ARP spoofing (24.5) or a monitor/SPAN port.
- On Wi-Fi, packets travel through the air, so anyone in range can capture them (encryption is what protects you).
Defensively, sniffing is also how you analyse problems and detect attacks – it is a core SOC and troubleshooting skill, not only an attacker tool.
Ravindra Bagale's Tip
"Mi network var aahe mhanje sagla traffic disel" ha gairsamaj aahe – switch mule tumhala fakt tumcha ani broadcast traffic disto. Baki baghayla ARP spoofing lagto, ani to detect hoto. He samajla ki tumhi attacker ani defender doghancha vichar karu shakta.
Practice task
In your notes, explain in two lines the difference between a hub and a switch for sniffing, and name one reason capturing on Wi-Fi is different from capturing on a wired switch.