Packet Sniffing and Wireshark Basics
Packet sniffing captures network traffic as it flows so you can inspect exactly what is being sent. With a tool like Wireshark, the abstract becomes concrete: you see the actual packets, headers, and — where traffic is unencrypted — payloads. It is indispensable for troubleshooting, protocol learning, and security analysis, on both the offensive and defensive sides.
How does sniffing work?#
A sniffer puts a network interface into a mode where it captures traffic and reads the packets. The scope of what you can see depends on your position:
| Position | You can capture |
|---|---|
| Your own host | Your device’s traffic |
| A switch SPAN/mirror port | Traffic copied from other ports |
| A network tap | An out-of-band copy of a link |
| After ARP spoofing | A victim’s traffic (an attack) |
Wireshark then decodes the capture, letting you filter by protocol, follow a TCP stream, and read the conversation layer by layer against the OSI model.
Why does it matter to both sides?#
For defenders, packet analysis is how you understand an incident at ground truth — what actually crossed the wire. For attackers, sniffing a segment can harvest credentials and data from any unencrypted traffic. Both facts point to the same lesson.
Packet analysis is the microscope of network security, feeding traffic analysis. More at the Network Security hub.
Frequently asked questions#
What is packet sniffing?
Packet sniffing is capturing network traffic as it passes a point on the network, then inspecting the packets. Tools like Wireshark and tcpdump let you see the actual contents of communications — headers, protocols, and any unencrypted payloads — which is invaluable for troubleshooting, security analysis, and understanding how protocols really behave.
Can you sniff encrypted traffic?
You can capture encrypted packets, but their payloads appear as ciphertext you cannot read without the keys. Sniffing still reveals metadata — who talked to whom, when, how much, and over which protocol — which can itself be sensitive. This is exactly why end-to-end encryption like TLS matters even on trusted networks.