Ethical Hacking
Network Sniffing
Every packet your network sends can be read by anyone on the same segment — unless it is encrypted. This lesson covers how to capture and read live traffic, what credentials and data leak through plaintext protocols, and what defenders can do about it.
The network sees everything
When data travels across a network it does so as a stream of packets — discrete chunks of bytes, each containing source and destination addresses alongside the actual payload. On a shared network segment, every device receives every packet whether it was addressed to them or not. Normally the network card silently discards packets not addressed to it. Put the card into promiscuous mode and it reads everything.
That is what a packet sniffer does. It instructs the network interface to capture all traffic on the segment — not just traffic addressed to the machine running the tool — and stores it for analysis. On a switched network this is limited to the local broadcast domain, but in many corporate environments the broadcast domains are large enough to capture significant traffic. On a wireless network, anyone within range can capture all unencrypted traffic without being connected to it at all.
Wireshark — capturing and reading packets visually
Wireshark is the most widely used packet analyser in the world. It captures traffic in real time, decodes dozens of protocols automatically, and provides a graphical interface for filtering and inspecting individual packets and sessions. Security teams use it for incident investigation. Pen testers use it to identify what traffic reveals about a network's configuration and security posture.
The scenario: You have a position on the same network segment as the Metasploitable target — either through a compromised host or a direct lab connection. The Metasploitable machine is running Telnet, FTP, and HTTP — all plaintext protocols. You want to capture live authentication attempts and read what the protocols reveal.
# Wireshark can be started from the Kali terminal
# Or launched from Applications → Sniffing & Spoofing → Wireshark
# Start Wireshark from terminal and immediately begin capture on eth0
wireshark -i eth0 &
# Useful Wireshark display filters — type these in the filter bar
# to isolate specific traffic from the full capture:
# Show only FTP traffic (port 21) — reveals FTP credentials in plaintext
# ftp
# Show only Telnet traffic (port 23) — every character typed is visible
# telnet
# Show only HTTP traffic — reveals form data, cookies, auth headers
# http
# Show traffic to or from a specific IP
# ip.addr == 192.168.56.101
# Show only packets containing the word "password" in the payload
# frame contains "password"
# Combine filters with and / or
# ftp or telnetBreaking it down:
The FTP protocol sends credentials as plain text with no encryption whatsoever. Packet 2 shows the username being sent. Packet 4 shows the password. Anyone on the same network segment running Wireshark can read both. This is why FTP should not exist on any production system that handles anything sensitive — and why its presence is always a finding in a pen test report.
Even before any credentials are exchanged, the FTP server announces "220 (vsFTPd 2.3.4)" in the very first packet of the session. Version information leaking in network traffic is a finding in its own right — it tells any observer on the segment exactly what software is running, without them needing to connect to the service at all.
tcpdump — command-line packet capture
Wireshark requires a graphical interface. When you are working on a headless server, over SSH, or in an automated pipeline, tcpdump is the tool. It captures packets and writes them to a file — which can later be opened in Wireshark for visual analysis — or pipes them directly to grep or strings for quick credential extraction.
tcpdump is installed on almost every Unix system by default. It can capture and save traffic from a compromised server for later analysis — a technique used both by pen testers demonstrating network-level exposure and by attackers who have positioned themselves on a network segment to harvest credentials passively.
# tcpdump captures packets from the command line — no GUI needed
# Requires root or CAP_NET_RAW capability to run
# -i eth0 capture on the eth0 interface
# -w capture.pcap write raw packets to a file instead of printing to screen
# the .pcap file can be opened directly in Wireshark later
# -v verbose mode — prints more detail about each captured packet
tcpdump -i eth0 -w /tmp/capture.pcap -v
# Filter for specific protocols while capturing — saves disk space
# and makes later analysis faster when only one protocol matters
# Capture only FTP traffic (port 21)
tcpdump -i eth0 -w /tmp/ftp_capture.pcap port 21
# Capture Telnet traffic — every keystroke visible in plaintext
tcpdump -i eth0 -w /tmp/telnet_capture.pcap port 23
# Quick extraction — pipe to strings to find readable text in captured packets
# useful for a fast first look without opening Wireshark
# -A prints packet contents in ASCII alongside hex
# grep -i "pass" filters lines containing "pass" — catches PASS and password
tcpdump -i eth0 -A port 21 | grep -i "pass\|user\|login"Breaking it down:
Piping tcpdump output through grep for keywords like "pass", "user", and "login" is a quick triage technique. It will not catch everything — especially if there are multiple FTP sessions or mixed traffic — but it surfaces credentials from plaintext protocols within seconds of running. On an engagement where FTP is confirmed open, running this command for five minutes during peak business hours often returns multiple credential pairs.
The capture returned both msfadmin:msfadmin and postgres:postgres — two accounts from two different services, captured passively without touching either service directly. This demonstrates why network-layer credential exposure is treated as a critical finding: a single compromised network position can harvest credentials from every service that uses plaintext protocols across the entire segment.
Reading a pcap file — analysing saved captures
Captures saved to .pcap files can be analysed offline — useful when the capture was taken on a server without a graphical interface and needs to be transferred back to Kali for detailed review. Wireshark opens pcap files directly. For command-line analysis, tcpdump reads them back with the -r flag, and tools like strings extract readable text from binary capture files.
# Read back a saved pcap file using tcpdump
# -r reads from a file instead of a live interface
# -A prints packet contents in ASCII so credentials are readable
tcpdump -r /tmp/capture.pcap -A
# Filter the saved capture for just FTP traffic
tcpdump -r /tmp/capture.pcap -A port 21
# Use strings to extract all readable text from the binary pcap file
# strings finds sequences of printable characters of 4+ length
# Useful for a broad first pass to see everything readable in the capture
strings /tmp/capture.pcap | grep -E "USER|PASS|login|password"
# Open the pcap in Wireshark for visual analysis
wireshark /tmp/capture.pcap
# Follow a TCP stream in Wireshark to read a full session
# Right-click any packet in the session → Follow → TCP Stream
# This reassembles the entire conversation and shows it as readable text
# Every command and response in a Telnet or FTP session becomes fully visibleBreaking it down:
The Wireshark TCP stream view reassembled a complete Telnet administrative session — login, the sudo su command elevating to root, and every command typed afterwards. This is the full session, not just the credentials. An attacker capturing this traffic would see exactly what the administrator was doing on the system, in real time, character by character. Telnet does not just expose passwords — it exposes everything.
Individual packets show fragments of a conversation. Following the TCP stream reassembles the entire exchange into a readable session. For HTTP it shows the full request and response. For FTP it shows every command and response. For Telnet it shows the entire terminal session. Right-click any packet from the target session and choose Follow → TCP Stream — this is the first thing to do with any captured plaintext protocol traffic.
What network sniffing reveals beyond credentials
Credentials are the most headline-grabbing finding from a sniffing exercise — but they are not the only thing a capture reveals. A thorough review of network traffic tells the story of what systems exist, what protocols they use, what software versions they announce, and how users interact with them.
Defences against network sniffing
The most effective defence against network sniffing is encryption — making captured traffic unreadable even if an attacker has a copy of every packet. But encryption alone is not complete. The transport is encrypted; the metadata is not. An attacker capturing encrypted traffic still learns which hosts are communicating, how often, and how much data they exchange. That metadata is more revealing than most people appreciate.
Encryption — the primary control
Replace every plaintext protocol with its encrypted equivalent. FTP → SFTP or FTPS. Telnet → SSH. HTTP → HTTPS. SMTP → SMTPS. This is not optional hardening — it is the baseline. Any service transmitting credentials or sensitive data over plaintext on a network where an attacker could position themselves is a critical finding in any pen test.
Network segmentation
Limiting broadcast domains reduces the blast radius of a compromised host. A flat network where every device can capture traffic from every other device means a single compromised workstation can harvest credentials from the entire organisation. VLANs and microsegmentation ensure that a compromised host on the user network cannot see traffic from the server network.
802.1X port authentication
Requiring devices to authenticate to the network before being granted access prevents an attacker who physically plugs a device into a network port from immediately capturing traffic. 802.1X does not prevent sniffing from a compromised endpoint — but it significantly raises the bar for physical access attacks, which are the most common sniffing threat in enterprise environments.
Teacher's Note: Wireshark's "Follow TCP Stream" feature is the single most useful function for pen testers reading captures. Get comfortable with it early. In a real engagement, opening a pcap file and following the TCP streams for any identified plaintext protocol sessions will surface more findings in ten minutes than manually reading individual packets for an hour.
Quiz
Scenario:
Scenario:
Scenario:
Up Next · Lesson 31
MITM Attacks
ARP spoofing, traffic interception, SSL stripping — positioning between two communicating parties and reading or modifying everything that passes between them.