Introduction to Ethical Hacking and Network Sniffing

Ethical hacking is the practice of legally probing systems and networks for vulnerabilities — before malicious actors do. As cybersecurity threats grow in sophistication and frequency, understanding how attackers think is no longer optional: it’s a core skill for every IT and CS professional. This guide introduces network sniffing, the foundational technique behind most network security assessments.

What Is Ethical Hacking?

Ethical hacking (also called penetration testing or white-hat hacking) is the authorized attempt to gain unauthorized access to a computer system, application, or data. The goal is to find and fix security weaknesses before a malicious actor exploits them.

The Ethical Hacker’s Code

• ✅ Authorized — Written permission from the system owner
• ✅ Defined scope — Clear boundaries on what can and cannot be tested
• ✅ Documented — Full report of findings and recommendations
• ✅ Legal — Compliant with all applicable laws (IT Act 2000, CFAA, GDPR, etc.)

The Hacking Lifecycle (5 Phases)

Phase 1: Reconnaissance  →  Collect information (passive/active)
Phase 2: Scanning        →  Identify open ports, services, vulnerabilities
Phase 3: Gaining Access  →  Exploit discovered vulnerabilities
Phase 4: Maintaining Access →  Establish persistence (backdoors, rootkits)
Phase 5: Covering Tracks  →  Clear logs, hide evidence of intrusion

Ethical hackers follow only Phases 1–3 in controlled test environments, and report all findings immediately.

Network Sniffing Explained

Network sniffing (packet sniffing) is the process of intercepting and analyzing data packets as they travel across a network. It’s how tools like Wireshark, tcpdump, and Scapy work.

How Packets Flow

[Your Machine]  →  [Switch/Router]  →  [Internet/Intranet]
     |                    |
     └────── Sniff here ──┘
             (promiscuous mode)

When a NIC (Network Interface Card) is set to promiscuous mode, it captures ALL packets on the network segment — not just those addressed to it.

Wireshark: The Essential Sniffer

Wireshark is the world’s most widely used network protocol analyzer. Here’s how to use it for legitimate auditing:

Installing and Launching

# Linux/Ubuntu
sudo apt install wireshark
sudo wireshark

# macOS
brew install --cask wireshark

# Windows
# Download from: https://www.wireshark.org/download.html

Essential Wireshark Filters

# Filter by IP address
ip.addr == 192.168.1.5

# Filter by protocol
http
dns
tcp
ftp

# Filter by port
tcp.port == 80
tcp.port == 443

# HTTP GET requests only
http.request.method == "GET"

# Show only DNS queries
dns.flags.response == 0

# Capture failed TCP handshakes (RST packets)
tcp.flags.reset == 1

Python Scapy: Scripted Packet Analysis

For programmable sniffing and testing, Scapy is the go-to Python library:

from scapy.all import *

# Sniff 10 packets on interface eth0 and display summaries
packets = sniff(iface="eth0", count=10)
packets.summary()

# Capture only HTTP packets (port 80)
http_filter = lambda pkt: TCP in pkt and pkt[TCP].dport == 80
http_packets = sniff(iface="eth0", lfilter=http_filter, count=20)

# Build and send a custom ICMP ping
ping = IP(dst="8.8.8.8") / ICMP()
response = sr1(ping, timeout=2, verbose=0)
print(f"Reply from: {response[IP].src}") if response else print("No reply")

Analyzing Captured Packets

from scapy.all import rdpcap, IP, TCP

# Load a .pcap file (from Wireshark capture)
packets = rdpcap("capture.pcap")

for pkt in packets:
    if IP in pkt:
        src = pkt[IP].src
        dst = pkt[IP].dst
        proto = pkt[IP].proto
        print(f"  {src} → {dst} | Protocol: {proto}")
        
        if TCP in pkt:
            print(f"    TCP {pkt[TCP].sport} → {pkt[TCP].dport}")

Common Attack Patterns to Detect

1. ARP Spoofing (Man-in-the-Middle)

# Detect ARP spoofing — multiple IPs with same MAC is suspicious
from scapy.all import sniff, ARP

arp_table = {}

def detect_arp_spoof(pkt):
    if ARP in pkt and pkt[ARP].op == 2:  # ARP reply
        ip = pkt[ARP].psrc
        mac = pkt[ARP].hwsrc
        
        if ip in arp_table and arp_table[ip] != mac:
            print(f"⚠️  ARP SPOOFING DETECTED: {ip} changed from {arp_table[ip]} to {mac}")
        else:
            arp_table[ip] = mac

sniff(filter="arp", prn=detect_arp_spoof, store=0)

2. Port Scanning Detection (Nmap-style)

# Multiple SYN packets to different ports = port scan!
from scapy.all import sniff, IP, TCP
from collections import defaultdict

syn_counts = defaultdict(set)

def detect_port_scan(pkt):
    if TCP in pkt and pkt[TCP].flags == 'S':  # SYN flag
        src_ip = pkt[IP].src
        dst_port = pkt[TCP].dport
        syn_counts[src_ip].add(dst_port)
        
        if len(syn_counts[src_ip]) > 20:
            print(f"🚨 PORT SCAN from {src_ip} ({len(syn_counts[src_ip])} ports)")

sniff(filter="tcp", prn=detect_port_scan, store=0, count=200)

🤖 Interactive AI Widget: Packet Inspector Simulator

Simulate intercepting real network packets. Select a traffic scenario and see the decoded packet headers — just like Wireshark would show you.

Legal & Ethical Boundaries

⚠️ CRITICAL NOTE: All network sniffing must be performed only on networks you own, or have explicit written permission to test. Unauthorized packet capture is a criminal offense under the IT Act 2000 (India), Computer Fraud and Abuse Act (USA), and equivalent laws globally.

When You May Legally Sniff

• Your own home/lab network
• A test environment set up for practice
• During an authorized penetration test (signed agreement required)
• Educational tools running on localhost or isolated VMs

Key Tools Reference

Practice Lab Setup

# Set up an isolated ethical hacking lab using VMs
# Recommended: VirtualBox or VMware Workstation

# Tools to install in Kali Linux VM:
sudo apt update && sudo apt install -y \
    wireshark \
    nmap \
    python3-scapy \
    tcpdump \
    netcat

📚 Recommended Reading: The Web Application Hacker’s Handbook by Stuttard & Pinto. Penetration Testing by Georgia Weidman.