Ethical Hacking Sniffing Syllabus

Sniffing syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Sniffing in Ethical Hacking, not a summary of it.

1. 1

   Sniffing Concepts

   3 topics

   • What is Sniffing?
   • Types of Sniffing
   • Promiscuous Mode
2. 2

   Sniffing Tools

   3 topics

   • Wireshark
   • Tcpdump
   • Ettercap
3. 3

   Countermeasures

   3 topics

   • Encryption
   • Network Segmentation
   • Intrusion Detection Systems

Sniffing flashcards for Ethical Hacking

25 of 50 cards from the Sniffing deck — real questions with worked answers.

1. What is sniffing in the context of network security?

   Sniffing is the process of capturing, monitoring, and inspecting data packets as they travel across a network, typically using a packet-capturing tool (sniffer) to intercept traffic passing through a network interface.

2. What is the primary goal of a sniffing attack?

   To intercept and read sensitive data traversing the network, such as usernames, passwords, emails, session tokens, and other confidential information, often from unencrypted (cleartext) traffic.

3. At which OSI layer does packet sniffing primarily operate to capture raw frames?

   The Data Link layer (Layer 2), where the network interface card captures raw Ethernet frames; sniffers then parse higher-layer data (IP at Layer 3, TCP/UDP at Layer 4, etc.).

4. What are the two main types of sniffing?

   Passive sniffing and active sniffing.

5. What is passive sniffing and where is it typically used?

   Passive sniffing is capturing traffic without injecting packets into the network. It works on hub-based networks where traffic is broadcast to all ports, so the attacker simply listens and is very hard to detect.

6. What is active sniffing and why is it needed on switched networks?

   Active sniffing involves injecting traffic (e.g., ARP spoofing, MAC flooding) into the network to redirect or capture packets. It is needed on switched networks because a switch forwards frames only to the intended port, not to all ports.

7. Why is passive sniffing ineffective on a modern switched network by default?

   A switch maintains a MAC address table (CAM table) and forwards unicast frames only to the specific port of the destination MAC, so an attacker's port does not receive other hosts' traffic without an active technique.

8. What is MAC flooding and how does it enable sniffing?

   MAC flooding sends a large number of frames with fake source MAC addresses to overflow the switch's CAM table. When the table is full, many switches fail-open and behave like a hub, broadcasting frames to all ports so the attacker can sniff them.

9. What is ARP spoofing (ARP poisoning) as an active sniffing technique?

   The attacker sends forged ARP replies to associate their own MAC address with the IP of another host (often the gateway), causing victims to send traffic through the attacker, enabling a man-in-the-middle position for sniffing.

10. What is DHCP starvation and how does it relate to sniffing?

    DHCP starvation floods a DHCP server with requests using spoofed MACs to exhaust its address pool. This can be paired with a rogue DHCP server to reroute victim traffic through the attacker for sniffing.

11. What is promiscuous mode on a network interface card?

    Promiscuous mode is a NIC configuration in which the card passes all received frames to the CPU regardless of destination MAC address, instead of discarding frames not addressed to it. It is required for sniffing traffic not destined for the host.

12. In normal (non-promiscuous) mode, which frames does a NIC accept?

    Frames whose destination MAC matches the NIC's own MAC address, plus broadcast frames and subscribed multicast frames; all other frames are discarded by the hardware.

13. What is monitor mode and how does it differ from promiscuous mode?

    Monitor mode is a wireless (802.11) mode that captures all radio frames on a channel without associating to an access point, including management/control frames. Promiscuous mode captures frames on a network the host is already connected to and does not capture other-network 802.11 management frames.

14. What is Wireshark?

    Wireshark is a free, open-source, cross-platform GUI network protocol analyzer used to capture and interactively browse traffic on a network, with deep inspection and dissection of hundreds of protocols.

15. Which underlying libraries does Wireshark use to capture packets on different platforms?

    libpcap on Unix/Linux/macOS and Npcap (formerly WinPcap) on Windows.

16. What is the difference between a capture filter and a display filter in Wireshark?

    A capture filter (BPF syntax) limits which packets are recorded during capture and cannot be changed retroactively; a display filter is applied after capture to show a subset of already-captured packets and can be changed freely.

17. Write a Wireshark display filter that shows only HTTP traffic and only TCP packets to port 443.

    For HTTP use $\texttt{http}$; for TCP to port 443 use $\texttt{tcp.port == 443}$. Combined example: $\texttt{http || tcp.port == 443}$.

18. In Wireshark, what does the 'Follow TCP Stream' feature do?

    It reassembles and displays the full bidirectional application-layer conversation of a TCP session in order, making it easy to read exchanged data (e.g., an entire HTTP request/response or login exchange).

19. What is Tcpdump?

    Tcpdump is a free, open-source command-line packet analyzer that captures and displays TCP/IP and other packets transmitted or received over a network, using the libpcap library.

20. What is the tcpdump command-line syntax to capture on interface eth0 and write to a file?

    $\texttt{tcpdump -i eth0 -w capture.pcap}$ captures on eth0 and writes raw packets to capture.pcap; $\texttt{-r capture.pcap}$ reads them back.

21. Which filter language do both tcpdump and Wireshark capture filters use?

    Berkeley Packet Filter (BPF) syntax.

22. Write a tcpdump filter expression that captures only traffic to or from host 10.0.0.5 on port 80.

    $\texttt{host 10.0.0.5 and port 80}$

23. What does the tcpdump flag -n do?

    It disables name resolution, printing numeric IP addresses and port numbers instead of resolving them to hostnames and service names, which speeds up output and avoids DNS lookups.

24. What is Ettercap?

    Ettercap is a free, open-source comprehensive suite for man-in-the-middle attacks on LANs, supporting sniffing of live connections, content filtering, and active/passive dissection of many protocols including ARP poisoning.

25. Name two core capabilities of Ettercap beyond simple packet capture.

    ARP poisoning (to place itself as MITM on a switched LAN) and on-the-fly content filtering/injection or credential harvesting from dissected protocols; it also supports DNS spoofing via plugins.

See more Sniffing flashcards →

Planning Sniffing for Ethical Hacking

Sniffing (Ethical Hacking) FAQ