Academy
TermTechnique

Network sniffing

Capturing traffic passing over a network and reading the information in it, especially unencrypted credentials.

Flow

  1. 1Gets into position
  2. 2Captures traffic
  3. 3Extracts information
Related families
—
MITRE ATT&CK
T1040 · Network Sniffing
Sources
4 sources
01

Overview

NIST defines a sniffer as a program that monitors and captures network traffic. Network administrators use the same tools for troubleshooting. NIST CSRC

Because most traffic is now encrypted, sniffing focuses mostly on legacy protocols inside internal networks and on man-in-the-middle attacks. MITRE ATT&CK

02

How it works

  1. 1

    Gets into position

    The attacker compromises a device that can see the traffic. MITRE ATT&CK

  2. 2

    Captures traffic

    The network interface is put into a mode that listens to all packets. MITRE ATT&CK

  3. 3

    Extracts information

    Passwords and session data are pulled from unencrypted protocols. MITRE ATT&CK

03

How to detect it

  • A network interface switched into a mode that listens to all packets, and unrecognised capture tools. MITRE ATT&CK
04

What to do

  • Disable unencrypted protocols; use encryption for internal traffic too. MITRE ATT&CK
  • Use multi-factor authentication so that a captured password is not enough on its own. MITRE ATT&CK
05

MITRE ATT&CK

T1040Network SniffingT1557Adversary-in-the-Middle
06

Related terms

Terms

Lateral movementSession hijackingZero trust
07

Sources

  1. 1Network Sniffing (T1040) · MITRE ATT&CK
  2. 2Adversary-in-the-Middle (T1557) · MITRE ATT&CK
  3. 3Sniffer — glossary definition · NIST CSRC
  4. 4Multi-factor Authentication (M1032) · MITRE ATT&CK