Sniffing and Spoofing

The Problem: Traffic You Can See, Traffic You Should Not

On a modern switched Ethernet network, a host only receives frames addressed to its own MAC address (plus broadcast and multicast). That is by design — switches maintain a MAC address table that maps each port to the devices connected to it, so unicast traffic between two other hosts never reaches your NIC. Sniffing is the set of techniques that breaks that assumption, either by exploiting the network medium itself or by forcing the network to deliver traffic to you anyway.

Promiscuous Mode and Shared Media

Every network interface has two operating modes. In normal mode, the NIC inspects the destination MAC of each incoming frame and silently discards anything not addressed to it. In promiscuous mode, the NIC passes every frame it sees up to the operating system regardless of the destination address. This is a legitimate feature — packet analyzers like Wireshark and tcpdump depend on it — but it means any process running on a host with promiscuous-mode capability can observe all traffic on the wire.

On a hub-based network (or any shared-medium segment like old coax Ethernet or unencrypted Wi-Fi), every frame reaches every port. A host in promiscuous mode sees everything without any additional attack. This is why hub-and-spoke topologies were abandoned: a single compromised host on a hub segment could capture credentials, session tokens, and plaintext protocol data for the entire broadcast domain.

# Enable promiscuous mode on Linux
ip link set eth0 promisc on

# Verify the flag is set
ip link show eth0 | grep -i promisc
# Output: ... BROADCAST,MULTICAST,UP,LOWER_UP,PROMISC ...

# Capture all traffic with tcpdump
tcpdump -i eth0 -w capture.pcap

Why Switched Networks Changed the Game

Switches eliminated the passive sniffing problem for wired networks by forwarding unicast frames only to the port where the destination MAC was last seen. If an attacker plugs into a switch port, they only see their own traffic plus broadcasts. To sniff other hosts' traffic on a switched network, the attacker must actively manipulate the forwarding logic. The two primary methods are:

1. MAC flooding — overwhelm the switch's CAM table with fake MAC addresses until the switch fails open and broadcasts all traffic like a hub.
2. ARP spoofing — poison the ARP cache of a target so the target sends traffic to the attacker's MAC instead of the real gateway.

MAC flooding is noisy and easily detected by port security features. ARP spoofing is surgical and remains the dominant technique for switched-network sniffing.

Wireless Sniffing

Wi-Fi is inherently a shared medium — all frames on a channel propagate through the air. A wireless NIC in monitor mode captures every frame on the channel, including traffic between other clients and the access point. On an open network or a network using WPA2-PSK, an attacker who captures the 4-way handshake can decrypt all traffic if they know the pre-shared key. On WPA3 with SAE, forward secrecy prevents offline decryption of captured sessions.

# Put wireless interface into monitor mode
sudo airmon-ng start wlan0

# Capture all frames on channel 6
sudo airodump-ng wlan0mon --channel 6 -w wireless_capture

The defensive takeaway is consistent across wired and wireless: encryption (TLS, IPsec, WPA3) renders captured traffic unreadable even when sniffing succeeds. Sniffing is a real threat, but it is not a reason to panic if your traffic is encrypted end to end.

The Protocol That Trusts Everyone

The Address Resolution Protocol maps IP addresses to MAC addresses on a local network segment. It was designed for a trusted environment and has no authentication. When a host wants to send a packet to an IP address, it broadcasts an ARP request: "Who has 192.168.1.1? Tell 192.168.1.100." The owner of 192.168.1.1 replies with its MAC address. The requester caches this mapping for a period (typically 2–20 minutes depending on OS) and sends frames to that MAC.

The critical flaw: any host on the segment can send an unsolicited ARP reply, and the recipient will update its cache without question. There is no verification that the replier actually owns the claimed IP address.

The Attack Step by Step

An attacker on 192.168.1.0/24 wants to intercept traffic between a victim (192.168.1.100) and the gateway (192.168.1.1). The attacker sends gratuitous ARP replies to both:

• To the victim: "192.168.1.1 is at [attacker's MAC]"
• To the gateway: "192.168.1.100 is at [attacker's MAC]"

Now the victim sends all traffic destined for the gateway to the attacker's machine, and the gateway sends all return traffic to the attacker's machine. The attacker forwards the traffic in both directions (so the connection stays up) while capturing or modifying every packet. This is the foundation of a man-in-the-middle attack.

# ARP spoofing with arpspoof (dsniff suite)
# Tell the victim that the gateway is the attacker
arpspoof -i eth0 -t 192.168.1.100 192.168.1.1

# Tell the gateway that the victim is the attacker
arpspoof -i eth0 -t 192.168.1.1 192.168.1.100

# Enable IP forwarding so traffic flows through the attacker
echo 1 > /proc/sys/net/ipv4/ip_forward

Detecting ARP Spoofing

The telltale sign is a single MAC address claiming to be multiple IP addresses, or an IP-to-MAC mapping that changes without a corresponding DHCP lease or device reboot. Defenders can detect this with:

• arpwatch — logs ARP mappings and alerts on changes
• Static ARP entries — pin critical mappings (gateway, DNS servers) so they cannot be overwritten
• Dynamic ARP Inspection (DAI) — a switch feature that validates ARP packets against a trusted binding table and drops invalid replies

# Set a static ARP entry for the gateway
sudo arp -s 192.168.1.1 00:11:22:33:44:55

# View the ARP cache
arp -a

IP and DNS Spoofing

ARP spoofing is local to a broadcast domain. IP spoofing operates at a different layer — the attacker forges the source IP address in packet headers to impersonate a trusted host. This is common in DDoS reflection attacks where the attacker spoofs the victim's IP as the source, causing reflection servers to send amplified responses to the victim.

DNS spoofing corrupts the domain-to-IP resolution process. An attacker who can answer DNS queries faster than the legitimate resolver (or who poisons a DNS cache) can redirect victims to malicious sites. DNSSEC adds cryptographic signatures to DNS records, making cache poisoning detectable.

Layered Defense Against Sniffing and Spoofing

No single control eliminates sniffing and spoofing. Defense requires layering network hardening, monitoring, and encryption so that even if one layer is bypassed, the attacker gains nothing of value.

Network-Level Controls

Port security on switches restricts which MAC addresses are allowed on each port. A port can be configured to learn a single MAC (sticky learning) or to accept only pre-configured addresses. If an attacker plugs in a rogue device, the port shuts down. This directly counters MAC flooding and casual ARP spoofing.

Dynamic ARP Inspection (DAI) validates every ARP packet against a binding table built from DHCP snooping. If an ARP reply claims an IP-to-MAC mapping that does not match the DHCP snooping database, the switch drops the packet and logs the violation. DAI is the most effective switch-level defense against ARP spoofing.

VLAN segmentation limits the broadcast domain. An attacker on the guest VLAN cannot ARP-spoof hosts on the corporate VLAN because ARP does not cross VLAN boundaries. Proper VLAN design confines the blast radius of any single compromised host.

Host-Level Controls

Static ARP entries for critical infrastructure (default gateway, internal DNS servers) prevent cache poisoning for those specific mappings. This is practical for small environments but does not scale to large dynamic networks.

Host-based intrusion detection tools like arpwatch or XArp monitor ARP traffic and alert when mappings change. On endpoints, endpoint detection and response (EDR) agents can detect packet capture tools (npcap, WinPcap) and promiscuous-mode interfaces.

Encryption: The Ultimate Defense

Even if an attacker successfully sniffs traffic, encryption makes the captured data useless. The controls that matter:

• TLS 1.3 for all application traffic — prevents credential and session token theft
• IPsec or WireGuard for site-to-site and remote-access VPNs — encrypts at the network layer
• SSH instead of Telnet — encrypted remote access
• DNSSEC — prevents DNS cache poisoning
• WPA3-SAE for wireless — forward secrecy prevents offline decryption

Monitoring and Detection

A SOC detects sniffing and spoofing through network traffic analysis:

• ARP mapping changes in switch logs or SIEM alerts
• Multiple IP addresses associated with a single MAC in a short window
• Promiscuous-mode detection via NDR (Network Detection and Response) tools
• Anomalous traffic patterns — a host suddenly receiving traffic not destined for it

# Detect ARP cache poisoning on Linux
# Watch for gratuitous ARP replies and mapping changes
sudo arpwatch -i eth0 -f /var/lib/arpwatch/arp.dat

# Check for promiscuous mode interfaces
ip link show | grep PROMISC

The key principle: assume the network is hostile. Design your defenses so that sniffing yields only ciphertext and spoofing is detected and blocked at the switch before it reaches endpoints.