What is a sniffing attack?
Sniffing means capturing the traffic flowing across a network to read its contents. A network card in promiscuous mode receives every packet on the segment, not just those addressed to it. If that traffic travels unencrypted, the attacker obtains credentials, session cookies, email and any data sent in the clear.
Passive and active sniffing
Passive sniffing only listens and is virtually undetectable: it works on hub-based networks or open wifi. Active sniffing must inject traffic to redirect packets toward the attacker, using techniques such as ARP poisoning or MAC flooding, and therefore leaves traces an IDS can spot.
How to protect against sniffing
End-to-end encryption is the underlying defense: with properly configured TLS, capturing traffic stops being useful. Add network segmentation, switches with ARP spoofing protection and port security, VPNs on untrusted networks, and inspection for devices running in promiscuous mode on the segment.
