TechKnowSurge
EC-Council CEH 4.1 CompTIA Security+ 2.4 Cisco CyberOps Associate 4.6 Cisco CyberOps Associate 1.9
TechKnowSurge Catalog Videos DEMO: Sniffing Attack with Wireshark
VideoSecurityFree

DEMO: Sniffing Attack with Wireshark

A sniffing attack passively captures network traffic to gather intelligence about devices, protocols, and infrastructure without sending a single packet. Wireshark is a common tool used to carry out and demonstrate this technique.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

A sniffing attack is a passive network reconnaissance technique in which an attacker captures and analyzes traffic traversing a network segment without actively sending packets or interacting with target systems. Because the attacker is only listening, the activity generates no anomalous traffic and is inherently difficult to detect through conventional monitoring. The same technique is also used legitimately by system administrators and security professionals to troubleshoot network issues and audit traffic, making intent the key distinction between defensive and malicious use. Wireshark is one of the most widely used tools for performing network sniffing, and even a low-activity network can yield a surprising volume of captured data. A single session can surface TCP connections, ICMP traffic, MDNS broadcasts, DHCPv6 exchanges, and protocol-specific messages such as Spanning Tree Protocol advertisements. That last category is particularly valuable from an attacker's perspective, as STP frames can reveal device vendors, network topology, and the presence of managed infrastructure like Cisco switches, all of which can inform follow-on exploitation efforts targeting known vulnerabilities in those devices.

What you'll learn

What's covered

Sniffing Attacks

Aligned to

EC-Council CEH
4.1 Sniffing
CompTIA Security+
2.4 Given a scenario, analyze indicators of malicious activity.
Cisco CyberOps Associate
4.6 Extract files from a TCP stream when given a PCAP file and Wireshark
1.9 Identify potential data loss from traffic profiles

Key terms

Packet
A unit of data formatted for transmission over a network, containing a header, payload, and sometimes a trailer.
Transmission Control Protocol
TCP
A connection-oriented transport protocol that ensures reliable, ordered, and error-checked delivery of data.
Internet Control Message Protocol
ICMP
A network layer protocol used to send error messages and operational information about network conditions.
Dynamic Host Configuration Protocol
DHCP
A network protocol that automatically assigns IP addresses and other configuration parameters to devices on a network.
Spanning Tree Protocol
STP
A network protocol that prevents loops in Ethernet networks by creating a loop-free logical topology.
Sniffing Attack
A passive network attack in which an attacker captures and analyzes network traffic using a packet analyzer to gather information such as device types, protocols, and data in transit.
Packet Analyzer
A tool used to capture and inspect packets traversing a network, such as Wireshark, enabling analysis of protocols and data being transmitted.

Topics

Network Security Wireshark Packet Analysis Sniffing Attacks Passive Reconnaissance Networking

Transcript

A sniffing attack is similar to a wire tap, and some would say that it's a type of wire tap. A sniffing attack is just listening to the communication that's coming across the network. This is great because this is a passive way to see what traffic is on the network. We might be plugged into this and seeing the traffic that's going across and coming to us - probably not all the traffic, but there is some traffic that's coming to us. And then also we could be compromising another machine and analyzing the traffic that's coming into that machine.

Just a reminder that this is for ethical hacking purposes only. Make sure you only do this on a network that either you own or have gotten permission to carry out these techniques on.

Capturing on a Quiet Demo Network

I'm on a demo laptop here and it's plugged into a demo network. This demo network doesn't have a lot of equipment on it - very little equipment, actually. I'm going to open up Wireshark and we're going to take a look at what this looks like. It's this Ethernet port that's connected to this demo network that has very few machines on it, and I'm going to open it up.

So despite having this network with very few machines on it, you can see that it's very active. There's a lot of information that's being sent back and forth. I'm going to go ahead and stop this capture and we're going to look through here.

We see some TCP connections, some ICMP connections, mDNS connections, TCP. So you can see just a wealth of information that's coming across here. DHCP version 6. And each one of those is going to give us some information.

Finding Something Useful

Now, some of it's coming directly to this machine, and maybe we don't care as much about that because we've already discovered what we want to know about this machine. But we can see something like - whoa, look at right here, we've got a spanning tree message right here. So I can click on there, and this is a spanning tree message from one of the switches that are on this network. And I can first of all see that the switch is a Cisco device. So now I know they are using Cisco devices, at least for this Cisco switch that's running spanning tree protocol, and I can look at more information about spanning tree protocol to find out more information about this.

This can give me some great insight into what machines are on this network, what the network actually looks like, and I can start attacking maybe one of these Cisco switches because maybe it has some weaknesses to it. And so this is just an example of how I can, just by opening up on this simple network, find a wealth of information about this network.

The Attack Card

So here's the attack card on this. We've got the sniffing attack, just sniffing your network. Actually, we could do that as system administrators and security professionals, so there's actually good intentions to do some sort of network sniffing. But in this case right here, it's actually an attack, so it's a bad intent here of carrying out this attack, and it's just listening to the network traffic.

It's hard to detect. This is passive, so it's hard to detect the fact that we're just listening. And one example of a tool that we can use for this is Wireshark.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →