What is packet sniffing? (2024)

Tom Bienkowski

Director, Product Marketing

What are packet sniffers?

Packet sniffers are applications or utilities that read data packets traversing the network within the Transmission Control Protocol/Internet Protocol (TCP/IP) layer. When in the hands of network administrators, these tools “sniff” internet traffic in real-time, monitoring the data, which can then be interpreted to evaluate and diagnose performance problems within servers, networks, hubs and applications.

When packet sniffing is used by hackers to conduct unauthorized monitoring of internet activity, network administrators can use one of several methods for detecting sniffers on the network. Armed with this early warning, they can take steps to protect data from illicit sniffers.

NETSCOUT's Omnis Network Security platform utilizes packet-based analysis for advanced threat analytics and response.

NETSCOUT Uses the Power of the Packet Across our Platform

What is the difference between the term “sniffer” and “Sniffer?”

When spelled with a lowercase “s,” the term “sniffer” indicates the use of a packet sniffing tool for either good or nefarious purposes. In the hands of authorized network administrators, a sniffer is employed to maintain the unimpeded flow of traffic through a network. Conversely, in the hands of a hacker, a sniffer may be used for unauthorized monitoring of the network.

When spelled with an upper case “S,” the term “Sniffer” refers to trademarked technology from NETSCOUT. This branded sniffer enables network administrators to monitor bandwidth and ensure that no single user is using too much available capacity.

Is the original Sniffer still available today?

Network General Corporation (now known as Network Associates Inc.) introduced the Sniffer Network Analyzer in 1988. Since then, the Sniffer has passed through several hands, including McAfee. In 2007, NETSCOUT acquired Network General, along with Sniffer. The first generation of Sniffer read the message headers of data packets on the network. This monitoring tool provided administrators with a centralized global view of all network activity, offering details such as the addresses of senders and receivers, file sizes and other packet-related information.

Leverage Valuable Packet Data with NETSCOUT

How do hackers use packet sniffing?

Hackers will typically use one of two different methods of sniffing to surreptitiously monitor a company’s network. In the case of organizations with infrastructure configured using hubs that connect multiple devices together on a single network, hackers can utilize a sniffer to passively “spy” on all the traffic flowing within the system. Passive sniffing, such as this, is extremely difficult to uncover.

When a much larger network is involved, utilizing numerous connected computers and network switches to direct traffic only to specific devices, passive monitoring simply won’t provide access to all network traffic. In such a case, sniffing won’t be helpful for either legitimate or illegitimate purposes. Hackers will be forced to bypass the constraints created by the network switches. This requires active sniffing, which adds further traffic to the network, and in turn makes it detectable to network security tools.

How to protect networks from illicit sniffers

There are several steps organizations can take to protect their networks from illicit sniffing activities. The following defenses can reduce the risk of exposure to hackers:

• Do not use public Wi-Fi networks: Wi-Fi networks found in public spaces typically lack security protocols to fully protect users. Hackers can easily sniff the entire network, gaining access to sensitive data. Avoiding such networks is a wise security choice unless the user is accessing an encrypted VPN.
• Rely on a trusted VPN connection: When accessing the internet remotely, always use a trusted Virtual Private Network that encrypts the connection and masks all data from sniffers. Any sniffer attempting to monitor traffic over a VPN will only see data that has been scrambled, making it useless to the hacker.
• Look for secure HTTPS protocols before surfing the web: Before surfing the internet, look for the “HTTPS” in the address bar of a website. Some sites only indicate “HTTP.” The additional “S” at the end is an indication that the site adheres to more robust security protocols that encrypt communications and will prevent sniffers used by hackers from seeing the data.
• Don’t fall prey to social engineering tricks and traps: Hackers and cyberattackers will often employ phishing emails and spoofed website to trick people into unwittingly downloading sniffers. Being aware and cautious when browsing can prevent users from falling prey to nefarious tactics.