document updated 17 years ago, on Dec 31, 2008

802.3 wired ethernet
- modify the physical wiring
  - construct a passive ethernet tap
  - add a hub inline with the link you want to sniff
- unmanaged switches
  - use MAC flooding to force a switch into failopen mode, making it act like a hub
  - use ARP spoofing to create a MITM attack
  - more
- managed switches
  - set up port mirroring (in Cisco-lingo, it's the SPAN port; for others, see here)
802.11 wireless
- 802.11 inherently acts more like a "hub" than a "switch", so sniffing other wireless clients should be easy (as long as they're within RF range). However, driver support can sometimes be a problem, and it's important to understand the difference between monitor mode and promiscuous mode.
  - A huge upside is that the shared medium allows spoofing attacks that haven't been possible for more than a decade.
  - If you can capture in monitor mode, but not promiscuous mode, you can save and decrypt the packets, to effectively capture in promiscuous mode.
- When wired(802.3) and wireless(802.11) networks are bridged at the L2 level (as most home gateways do), it's possible to use the <unmanaged switch attacks> above to sniff wired clients from the wireless side! (e.g. ARP spoofing, MAC flooding, ...)