Network Sniffing

What it is

Network sniffing captures packets visible at a network observation point. Administrators use it legitimately for troubleshooting; attackers use it to gather information. Plaintext content may be readable, while correctly encrypted traffic generally exposes less content but can still reveal some metadata such as destinations, timing, and volume.

How it works

The attacker obtains a suitable observation point through a compromised endpoint, network device, or monitoring interface. Switched networks do not automatically deliver every packet to every user; visibility depends on topology and access. Sensitive legacy protocols can expose passwords or records when their traffic is observable.

How people get tricked

People assume internal traffic is private because it never leaves the organization. Engineers may leave diagnostic captures or monitoring ports broadly accessible. The resulting exposure can come from infrastructure permissions rather than a deceptive message.

Example scenario

An internal legacy application sends credentials without encryption. Someone with access to a network capture point reads those credentials from recorded packets.

Warning signs

• Unauthorized packet-capture tools or monitoring access.
• Unexpected network-device configuration changes.
• Sensitive applications still use plaintext transport.

If it happens to you

Remove unauthorized observation access and identify what traffic was visible during the relevant period. Rotate credentials exposed in plaintext and assess captured records. Encryption can reduce the scope, but endpoint compromise may expose data before encryption or after decryption.