Driftnet

Driftnet is a network surveillance tool designed to extract image files from unencrypted network traffic. It was released as part of the dsniff suite and was authored by Dug Song. The program runs on Unix-like systems and uses a packet capture interface to monitor traffic on a network. It scans TCP streams for image content, filtering for common image types such as JPEG, PNG, and GIF, and reconstructs and saves the image data to disk.

Operation is performed by examining captured packets for indications of image data, such as HTTP responses that deliver image content or image file headers. Driftnet reconstructs the data streams and writes identified images to files on disk. It can observe traffic on a network interface in promiscuous mode and, in some configurations, may require network-position techniques on switched networks to see traffic not addressed to the host. It does not decrypt encrypted traffic and is limited to unencrypted protocols like HTTP.

The tool raises privacy and legal concerns because it can capture images from users without consent. On modern networks, the usefulness of driftnet is limited by encryption (HTTPS/TLS) and by security measures that reduce traffic visibility. Its use is generally considered inappropriate in environments where user privacy and legal compliance are expected, and it is often cited as an example of risk in discussions of network monitoring.

History and status: Driftnet originated in the late 1990s as part of Dug Song’s dsniff suite. It has been included in various security distributions, but its maintenance has waned over time, and its practicality on current networks is limited by prevailing security practices.