Chapter 4 · Network Security· Beginner· ~12 min

Sniffing, Spoofing, MITM

Any unencrypted traffic is, in principle, public. And a clever attacker doesn't need to break the encryption, just to sit in the middle.

You will learn

  • What sniffing is, and what it does and doesn't see today
  • How ARP and DNS spoofing turn a quiet observer into an active man-in-the-middle
  • What "downgrade attack" means and how it works
  • Defenses, in roughly the order they matter

Sniffing: just listening

Network sniffing means capturing packets as they pass. On a wired switch you usually only see your own traffic plus broadcasts; on a wireless network in monitor mode you can see every nearby frame. Wireshark is the canonical tool.

Sniffing used to expose passwords, emails, and entire web pages because so much traffic was plaintext. Today, most app traffic is TLS, so what an observer sees is more like a billing report: who you talked to, for how long, how many bytes. That metadata is still valuable, but it isn't the everything-in-the-clear bonanza of a decade ago.

What sniffing still sees

SNI (the hostname inside TLS), DNS queries when not encrypted, the size and timing of traffic, and any protocol you forgot to upgrade. "Use HTTPS" helps a lot but doesn't hide everything.

Spoofing: pretending to be someone else

Spoofing is sending packets with a forged source. Two of the most common forms target the plumbing rather than the apps:

  • ARP spoofing. On a local network, the Address Resolution Protocol maps IP addresses to MAC addresses. An attacker keeps shouting "I am the gateway", and the other devices believe them. From that point on, all the victim's traffic flows through the attacker.
  • DNS spoofing. Either by poisoning a recursive resolver's cache or by replying faster than the legitimate server on a flaky network, the attacker hands the victim a malicious IP address for a real domain.

MITM: the on-path attacker

Combine sniffing with spoofing and you have a man-in-the-middle (or on-path) attacker: someone who sees the traffic and can modify it, while both endpoints think they are talking directly to each other.

MITM is the most dangerous network position because it lets the attacker do everything:

  • Read traffic that isn't encrypted.
  • Inject responses (fake DNS, fake redirect, fake update).
  • Strip TLS by downgrading or impersonating endpoints.
  • Replay captured requests.

Downgrade attacks

A downgrade attack pushes a protocol negotiation toward something weaker. Classic examples:

  • SSL stripping: rewrite https:// links to http:// on the way to the user's browser.
  • Forcing TLS to fall back to an older, broken version (e.g. POODLE).
  • STARTTLS stripping: tear out the "hey, let's upgrade to TLS" line in a plaintext SMTP exchange.

The defense is to refuse to negotiate down. Modern TLS, HSTS, and MTA-STS all express the rule "encryption is required; if it isn't there, fail loud, don't fall back."

Defenses, roughly in order

  1. End-to-end encryption with authentication. TLS done right resists sniffing, MITM, and tampering. Almost everything in this module is solved if endpoints authenticate each other.
  2. HSTS. Tells browsers to only ever speak HTTPS to your site, preventing stripping.
  3. Encrypted DNS (DoH, DoT) plus DNSSEC validation.
  4. Switched networks and 802.1X in enterprise environments so the attacker can't even reach the wire.
  5. Static ARP entries for highly sensitive paths (rarely practical, but exists).
  6. Don't trust untrusted networks for anything that isn't already authenticated end to end.

Coffee-shop Wi-Fi, in one paragraph

If a site is HTTPS and your device trusts no rogue root certificates, an attacker on the same Wi-Fi can't read your session. They can see what domains you visit (via SNI and DNS), roughly when and how much data you send, and that's about it. It's not the nightmare it used to be, but it's not zero.

Take the quiz