How Packet Capture Works

A network interface card normally discards packets not addressed to its MAC address. Promiscuous mode disables this filter, causing the NIC to pass all frames it receives to the operating system regardless of destination. With administrator privileges, any application can put the interface into promiscuous mode and receive all traffic visible on the network segment, not just traffic addressed to that machine.

libpcap is a portable C library that provides a standard API for packet capture on Unix-like systems. WinPcap and its successor Npcap provide the equivalent on Windows. Virtually every packet capture and network analysis tool, including Wireshark, tcpdump, and Snort, uses libpcap as the underlying capture engine. It handles the low-level interaction with the operating system and exposes a filter language for selecting specific packets.

Wireshark is the most widely used graphical packet analysis tool. It captures live traffic or opens saved PCAP files and decodes hundreds of protocols, reassembling TCP streams and displaying decrypted content when keys are available. Colour-coded packet rows, display filters, stream following, and protocol statistics make it an essential tool for both network troubleshooting and security analysis.

tcpdump is a command-line packet capture tool available on virtually all Unix systems. A simple command like tcpdump -i eth0 port 80 captures all HTTP traffic on the eth0 interface and prints each packet summary. The -w flag writes raw packets to a PCAP file for later analysis in Wireshark. tcpdump's BPF filter language allows precise selection of traffic by protocol, port, address, and flags.

On modern switched networks, the switch forwards packets only to the correct destination port, so a promiscuous-mode NIC only sees broadcast traffic and traffic addressed to its own MAC. ARP poisoning overcomes this. The attacker sends gratuitous ARP replies telling the victim that the attacker's MAC is the gateway, and telling the gateway that the attacker's MAC is the victim. All traffic flows through the attacker's machine.

After ARP poisoning succeeds, the attacker's machine receives packets from both victim and gateway. To avoid disrupting communication, the attacker forwards packets between them while reading or modifying the content. Tools like arpspoof from the dsniff suite and Ettercap automate ARP poisoning and traffic forwarding. The attack works silently on the local network segment and is difficult for victims to detect without dedicated ARP monitoring.

Before switches became standard, networks used hubs that broadcast every packet to all ports. On a hub-based segment, promiscuous mode without any poisoning was sufficient to capture all traffic from all hosts. Hubs are rare today outside of old legacy environments and some industrial control networks. However, Wi-Fi networks behave like hubs for traffic within the same wireless channel, making passive capture straightforward in monitor mode.

Network administrators use port mirroring (also called SPAN in Cisco terminology) to legitimately capture traffic for monitoring and troubleshooting. A managed switch is configured to copy all traffic passing through specified ports or VLANs to a dedicated mirror port connected to a monitoring device. This provides full traffic visibility without ARP poisoning and is the approved method for intrusion detection sensors and network taps.

Capturing network traffic you are not authorised to access violates laws in most jurisdictions, including the US Computer Fraud and Abuse Act and the UK Computer Misuse Act. Even within an organisation, capturing employee traffic may require consent and HR policy compliance. Penetration testers must have explicit written authorisation that covers packet capture. IT administrators typically require organisational policy approval to deploy network monitoring.

A packet capture of even a few minutes of network activity can reveal application versions from HTTP User-Agent headers, operating system fingerprints from TCP stack behaviour, internal hostnames from DNS queries, authentication credentials from legacy protocols, session cookies from HTTP traffic, and a map of all communicating systems and services. This reconnaissance value makes packet capture a primary attack tool.

The primary defence against packet capture is encrypting all network traffic so that captured packets contain only ciphertext. Dynamic ARP Inspection on managed switches validates ARP replies against a trusted DHCP binding table, preventing ARP poisoning. Port security limits which MAC addresses can appear on each switch port. Network segmentation limits the blast radius of any single compromised machine performing ARP attacks.

What is the purpose of ARP poisoning in a packet capture attack on a switched network?

Promiscuous mode lets a NIC receive all frames on the segment. libpcap is the foundation for all major capture tools. Wireshark and tcpdump are the primary analysis tools. ARP poisoning redirects switched traffic through an attacker machine for man-in-the-middle capture. Port mirroring provides legitimate monitoring without poisoning. Encryption is the primary defence; Dynamic ARP Inspection prevents the poisoning attack.