What is a packet sniffing attack? A cybersecurity guide

Packet sniffing definition

Packet sniffing is a hacking technique that involves collecting data packets that travel through an unencrypted computer network. Packet sniffers monitor the data packets in network traffic, with the aim of intercepting sensitive information (like personal financial details) to sell or use in other attacks.

How a packet sniffing attack works

A packet sniffing attack works by monitoring network traffic and collecting data traveling through your network, to and from the internet. The “sniffed” data might include personal information like banking details or login credentials, or it could simply include any data that passes through the network. Attackers can then leverage the data gathered through sniffing to use in other hacking attempts.

Sniffing attacks work best on unencrypted networks, so if you’re connected to a public Wi-Fi network in a cafe, airport, or hotel, use a VPN to encrypt your connection and help prevent hackers from accessing any personal data you share online. And only visit websites you know are safe. 

Here are the two main techniques used in packet sniffing attacks:

Active packet sniffing

Active network sniffing is typically used on bigger networks. As more devices connect to a single network, the need for a network switch arises. Network switches direct internet traffic where it’s meant to go, so that the amount of traffic doesn’t overwhelm every device connected to the network. 

An active packet sniffing attack injects extra traffic into the target network and waits for the network switch to redirect legitimate traffic. When that happens, the active sniffer gains access to the network switch thus launching the attack. This active type of sniffing attack is much more detectable because it has to make itself known in order to start sniffing.

Passive packet sniffing

On smaller networks where all devices are connected to a single network hub, passive sniffers are more common because an attack doesn’t need to rely on network switches to direct traffic. On these networks, passive sniffers can sit back and discreetly sniff the network packets that pass under their noses, collecting information as they go. Because no action is needed, passive sniffers are much more difficult to detect.

6 packet sniffing attack methods

While most packet sniffers are similar in that they rely on intercepting traffic on a network, they can take many subtly different forms. Sniffing attacks can target specific network areas, device ports, or websites. 

Here are a few of the methods sniffers use to monitor network traffic:

 1. Password sniffing

Password sniffers silently collect data packets containing passwords and other login data. These days, sniffing network traffic specifically for usernames and passwords is rare, because legitimate websites use https encryption and have better password security.  

Now, man-in-the-middle attacks — a type of network hijacking attack — are used for gathering password data.

2. DNS poisoning

DNS poisoning — also known as DNS spoofing or DNS hijacking — is a type of pharming attack that uses a packet sniffer to redirect internet traffic toward a malicious website. DNS poisoning attacks usually target companies that maintain large DNS servers tasked with changing website domain names to IP addresses to get traffic where it needs to go.

3. JavaScript sniffing

JavaScript sniffing — or formjacking — happens when hackers insert malicious code at the point of purchase on e-commerce websites. JavaScript sniffers are like the online version of ATM card skimmers, in that they aim to collect financial information — including your full name, payment card information, and other personal data.  

4. Address resolution protocol (ARP) spoofing

This type of active packet sniffing attack happens when a hacker spoofs the IP address of a host or device on a local area network (LAN). By doing this, traffic intended for the real destination ends up going to the hacker instead. 

5. DHCP attacks

During a DHCP starvation attack, the hacker floods the targeted network with fake DHCP requests, aiming to use all the allocated IP addresses for that network. This internet sniffing attack is normally used as a precursor to other types of attacks, like DoS (Denial of Service) attacks.

6. TCP session hijacking

TCP session hijacking exploits Transmission Control Protocol (TCP) connections, which ensure complete, orderly data transfer between senders and receivers. Once a connection is established between a sender and receiver, the TCP session hijacker gains access to the reliable data transfer occurring and starts sniffing network traffic.

Dangers of packet sniffing attacks

Sniffing in the computer security context can devastate a targeted network. Here are some of the most common threats associated with network sniffers:

• Network interruptions  
  Active sniffing attacks flood networks with extra traffic, which can severely disrupt connections to the network. For companies that rely on strong connections for their business or security, these outages can be devastating. 
• Leaked messages 
  Without proper network encryption, packet sniffers can intercept emails, direct messages, or other communications, exposing personal info and sensitive company data. 
• Private data leaks 
  Passive sniffing attacks can sit undetected on your network for a long time, giving hackers plenty of opportunities to collect your personal data. This can lead to your data being sold to data brokers or third-party advertisers. In serious cases, sniffing could lead to identity theft. 
• Financial loss 
  Even if you use incognito mode to do your banking, private browsing modes usually aren’t encrypted. Sophisticated internet sniffing attacks aren’t fooled by cute spy illustrations — they can collect your login and financial info if left undetected.
• Malware 
  Once a packet interceptor starts sniffing around, you’re at risk of having malicious software (malware) injected into your network directly or via an infected website you’re redirected to. And malware and other threats can wreak havoc on your devices.

How to prevent packet sniffing attacks

Because packet sniffing attacks are often difficult to detect, one of the best ways to deal with them is to prevent them from infiltrating your network in the first place. Here are a few ways to prevent sniffers from gaining access to your network and connected devices:

• Set up a firewall. 
  Most new devices come with a built-in firewall. Ensure your firewall is enabled to give your computer a second line of defense against packet sniffers trying to break into your home network. 
• Use an antivirus. 
  Installing a strong antivirus tool can help protect your devices from any sniffers that may be hiding out on your computer or network. It can also help block malware, viruses, and other threats that may accompany sniffing attacks. 
• Update your computer software. 
  One of the easiest and best ways to prevent packet sniffing is to keep your software updated. Keeping your apps and operating system up to date helps patch vulnerabilities that attackers can otherwise exploit. 
• Only connect to trusted Wi-Fi networks. 
  Aside from using an anti-sniffing tool to detect network sniffers, ensure you only connect your device to trusted Wi-Fi networks. Private networks are less likely to fall victim to passive sniffing attacks. 
• Connect with a VPN. 
  VPNs create an encrypted tunnel through which your network traffic travels. By using a VPN, you protect the data packets sent and received on your network, helping to shield them from packet interception.

Protect yourself from sniffing

Packet sniffing attacks are a lot less adorable than they sound. And by the time you detect them lurking on your network, they may have already collected data packets containing sensitive information. That’s why it’s important to be proactive about your online privacy. 

Norton VPN encrypts your network connection to ensure the sensitive data you send and receive online stays private — whether you’re at home or connecting to public Wi-Fi. Help protect your data and keep network sniffers off the scent with Norton VPN.

FAQs about packet sniffing attacks

Can packet sniffing be detected?

Active packet sniffing attacks are easier to detect than passive attacks. Most packet sniffing attacks are passive (meaning they quietly collect data traveling through your network), which makes them extremely difficult to detect. But an active sniffer is forced to interact with the network it’s monitoring, thereby flooding the network with extra traffic and making it easier to detect.

How do hackers use packet sniffing?

Hackers use packet sniffing attacks to monitor and collect information shared in unencrypted data packets that travel through a network. After the packets are collected — either by active sniffing (redirecting network traffic) or passive sniffing (discreetly monitoring network traffic) — hackers can use the stolen info to launch attacks or sell the information to third parties.

Does a VPN prevent a packet sniffing attack?

Yes, a VPN (virtual private network) can help prevent a packet sniffing attack. VPNs encrypt all your network traffic, which makes it much more difficult for packet sniffers to see the actual data that gets sent through a network. Without an encrypted connection, your internet traffic is potentially exposed to packet sniffing attacks and other threats.