What a Sniffer Sees on YOUR Network

On a wire or a Wi-Fi radio, data travels as frames. A sniffer (packet analyzer) copies those frames into a view: Ethernet or 802.11 headers, IP addresses, ports, and — if nothing encrypted the application bytes — the HTTP method, path, Host header, cookies, and body. That is a powerful microscope for a defender who owns the path: “why is MY app still talking HTTP,” “did MY client send a token in a query string,” “is MY lab server logging the GET I just issued.” The microscope does not know ethics. Promiscuous mode, in one sentence, means a NIC that will accept frames not addressed to it. That sentence is literacy. Turning it on in a café so you can watch other guests is not a lab. It is other people’s traffic.

Shared hubs (rare now) repeated every frame to every port. Switches usually deliver a frame only to the port that owns the destination MAC. Wi-Fi is a radio: nearby adapters can hear energy, and modern WPA protects the air so a stranger should not read your inner payload just by sitting nearby. None of those topology facts is a hall pass. “The radio was in the air” is not consent. “The café had no password” is not consent. “Wireshark was already installed” is not consent. If you cannot say this frame left or entered a system I am allowed to observe, you do not capture it. Loopback is the classroom because those packets never left the machine.

sudo apt install wireshark
sudo apt install tcpdump

brew install --cask wireshark

choco install wireshark

cat >> "$NOTES" << 'EOF'
sniffer_means: a process that copies frames it can see
consent: not created by the tool existing
in_scope: loopback / a VM I own / written RoE
out: cafe, campus, neighbor air
EOF

HTTP/1.1 on port 80 is famous in sniffing talks because it is readable. A GET line names the path. Host names the site. Cookie and Authorization headers may carry session tokens. A POST body may carry a password. If an on-path observer is allowed to see that path (YOUR lab, a network you own, a capture you authorized in writing), they can read those strings without cryptography. That is why this course will later make you generate YOUR own GET to a server YOU started and copy the request line from YOUR server log. You are proving the model on traffic you caused. You are not proving it on a stranger’s banking tab.

Cleartext is not only “http://”. Any protocol that sends application bytes without TLS — old mail on 110/143, telnet, some toy APIs — has the same volunteer problem. The defender sentence is: if the payload is readable on a path you do not fully trust, assume an allowed observer can copy it. The fix is not a better sniffer. The fix is encryption of the application data, which Topic 8 already named TLS. Module 8 will not teach you to decrypt other people’s TLS. It will teach you why you should have been using HTTPS so there is nothing useful to read.

sudo apt install curl
sudo apt install python3

brew install python3

curl -sS -m 2 -v "http://127.0.0.1:8000/" 2>&1 | grep -E "GET |Host:|HTTP/" | head

HTTPS is HTTP inside TLS. After the handshake you practiced in Topic 8, application records are ciphertext. An observer who may see the path still sees that two IPs talked, on which ports, roughly how many bytes, and often some metadata (Lesson 3). They should not see GET /account, the cookie, or the password. That is the whole point of carrying TLS into a sniffing module: the interesting secrets stop being interesting on the wire. A sniffer of TLS traffic is not a failure of the sniffer. It is a success of encryption.

Students who feel “sniffing is useless if everything is HTTPS” have learned the right lesson and the wrong mood. Defenders still capture on systems they own to debug THEIR services, confirm THEIR clients speak TLS, and notice leftover cleartext. Attackers who cannot read payloads still like metadata and leftover HTTP. Your job in this course is the defender mood: prefer HTTPS everywhere you control, do not capture strangers, and treat leftover cleartext on YOUR box as a finding to fix — not as a reason to hunt a café. Lesson 3 will split payload from metadata. Lesson 4 will show YOUR own HTTP request line so the scare is concrete and still in scope.

sudo apt install curl

curl -sS -m 8 -I "https://example.com/" | head -n 12

Write the allowed list before you ever think about a capture GUI. (1) Loopback — 127.0.0.1 — traffic between processes on THIS machine. (2) A network you own and administer: your home LAN, your lab VM’s virtual switch, a range named in written rules of engagement. That is the list for Module 8. Not the café. Not the hotel. Not the campus Wi-Fi. Not a roommate’s hotspot “because they probably would not mind.” Not promiscuous mode on a shared SSID. Skill does not create consent. A public radio is still other people’s sessions.

If you do not own a LAN, you still complete this lesson with definitions and a locked notes file. Do not “borrow” a coffee shop because loopback felt too easy. Easy is the point: you are learning the ethics of the microscope, not filling a pcap with strangers. Notes go to $HOME/cyberlium-lab with chmod 600 — the same hygiene as Topics 2, 6, 7, and 8. The file holds YOUR scope sentences. It does not hold a classmate’s cookies, a café dump, or a screenshot of someone else’s Host header. World-readable 777 on a shared PC fails even if you never opened Wireshark.

On a computer you own, create cyberlium-lab if needed. Fill the notes. Optional: read the Python contrast script so you see a sample request line as literacy — it is not a packet sniffer and it never opens a café interface. chmod 600. Do not add a pcap of the floor because the file felt too small. Lesson 4 is when you generate YOUR own HTTP on 127.0.0.1.

sudo apt install wireshark
sudo apt install tcpdump
sudo apt install python3

brew install --cask wireshark
brew install python3

choco install wireshark

cd "$HOME/cyberlium-lab"

python3 sniffer_scope_contrast.py || python sniffer_scope_contrast.py

{

You now treat a sniffer as a microscope with a permission boundary: localhost or a network you own. Cleartext volunteers secrets; TLS hides the payload; encryption is the fix, not a louder capture. Notes are locked in cyberlium-lab. This is original Cyberlium material covering the same domain as CEH v13 sniffing — not official training, not a cert, not an exam dump. Next — ARP and “Who Is Where” as a Concept — names the neighbor table, how defenders notice poison, and why this course will not give you a spoofing recipe against a roommate.