What Is A Packet Sniffer?

Date First Published: 14th October 2023

Topic: Computer Networking

Subtopic: Network Software

Article Type: Computer Terms & Definitions

Difficulty: Medium

Difficulty Level: 7/10

CONTENTS

Types Of Packet Sniffing
Security Risks

Learn about what a packet sniffer is in this article.

A packet sniffer, also known as a packet analyser is a piece of software used to gather and analyse some or all of the packets that pass through a computer network. Packet sniffers can be used on both wired and wireless networks and their effectiveness depends on how much they can inspect.

Types Of Packet Sniffing

The two main types of packet sniffing are:

Filtered packet sniffing - Only specific packets are captured for inspection. This is useful when looking for specific data and checking those parts that contain it.
Unfiltered packet sniffing - All packets are analysed, regardless of what data they contain. This allows a wider profile of the network traffic to be captured.

Security Risks

Not all packet sniffing is malicious. Packet sniffers are commonly used by network technicians to diagnose legitimate problems affecting network performance and by organisations to check employee's network usage and block any malicious processes. However, they can also be used to gain unauthorised access to data since it is possible to capture any information using a packet sniffer. Packet sniffers can capture information, such as which websites a user visits, what is viewed on the site, the contents and destination of any emails, and details about any downloaded files. This may make it possible to gain access to passwords and financial details that have been transmitted over the network.

Attackers can get hold of and inspect packets during their journey using packet sniffing software, which converts the packet into a readable form. This is similar to wiretapping, where stalkers put a listening microchip in a telephone to listen to conversations.

Public Wi-Fi connections are more vulnerable to packet sniffing because there are usually no restrictions on who can connect to it. With wireless networks, someone could sneakily connect to the network. However, mobile broadband connections, such as 4G are not vulnerable to packet sniffing at all and performing packet sniffing over wired connections would require a device to be physically connected to the access point. This is harder to do without someone noticing.

Encryption (SSL/TLS) can reduce the risks of packet sniffers. Although it won't prevent packet sniffers from being able to see source and destination information, it can encrypt the payload of data packets so that the sniffer can only see gibberish.