How Packet Sniffing Works on a Switched Network (and How to Shut It Down)
On an old shared Ethernet network, sniffing was easy. Everybody's traffic went everywhere, so you just listened. Then switches came along and made that harder. Harder, but not impossible.
Here's how sniffing works on a modern switched network, and how to defend against it.
What sniffing is
Packet sniffing is the process of monitoring and capturing the data packets passing through a network, using a software application or a hardware device. How well it works depends on the network type. In a shared Ethernet environment, a single bus connects all the hosts, so capturing all the traffic is simple. In the more common switched Ethernet network, each host connects to a switch instead of a hub, so capturing packets meant for other devices is a lot more difficult. Attackers use different methods to get around that.
Two ways to sniff a switched network
- ARP spoofing. The attacker sends spoofed ARP replies to make their machine look like the network's gateway. The target's ARP cache ends up with the wrong entry for the gateway, so all the traffic meant for the gateway passes through the attacker's machine instead.
- MAC flooding. Switches have limited memory for tracking which MAC address sits behind which port. The attacker bombards the switch with fake MAC addresses until that table fills up. On many switches, once that happens the switch fails open and starts acting like a hub, broadcasting packets out of all of its ports. At that point, sniffing is easy again.
Passive vs. active sniffing
Sniffing generally takes two forms:
- Passive sniffing sends no packets. It just captures and monitors what passes by. It's much quieter than active sniffing, but it only works in places with a common collision domain, like a segment where devices are connected to a hub. So it's only useful in certain situations. If you're physically inside an organization's office, or you've delivered a Trojan with sniffing capability, you can sniff traffic in a small area behind a single hub. (Network admins also get passive access on purpose, through a switch's mirror/SPAN port, to feed monitoring tools.)
- Active sniffing injects traffic into the network to make a switched LAN give it what it wants. Because of how switches work, and mitigations like port filtering, packets don't flow the way they do behind a hub. So the attacker has to be "louder" and use more aggressive techniques, like the ARP spoofing and MAC flooding above. Other active methods include DNS poisoning, DHCP attacks, and switch port stealing.
How to harden a network against sniffing
None of these is hard to understand, though doing all of them takes some work:
- Dynamic ARP Inspection (DAI): verifies ARP messages against trusted DHCP bindings, which helps stop spoofed ARP packets from getting through.
- Port security: limits the number of MAC addresses allowed on each port, and can bind specific addresses to specific ports. This also blunts MAC flooding.
- Intrusion detection systems: monitor network traffic and flag the anomalies that sniffing attacks can cause.
- Network segmentation: divides the network into smaller broadcast domains, which limits how much an attacker on one segment can see.
Takeaway
Here's the other half of the answer: encryption. Even if somebody does get a copy of your traffic, TLS and SSH mean what they capture is mostly unreadable. Sniffing is a lot less useful against HTTPS than it was against the plaintext protocols of the hub era. That's not a reason to skip the controls above, since an attacker can still learn who's talking to whom, but it's why "encrypt everything" belongs on the list too.
One last note: only sniff networks you own or have explicit permission to test. Sniffing someone else's network without permission is illegal in most places