sniffer

Sniffer is a term used in computing and networking to describe a tool or device that monitors, captures, and analyzes data as it travels across a network or other communication medium.

In networking, a packet sniffer, or network analyzer, records frames or packets for inspection by an administrator or security professional. Sniffers can operate on a single host (host-based) or at a network segment (network-based). Wireless sniffers specialize in capturing traffic on Wi-Fi and other wireless protocols, often requiring specialized hardware to access the radio signals.

Sniffers work by placing a network interface into promiscuous or monitor mode, capturing frames, and then decoding protocol headers to present user-friendly representations. They may apply filters to extract relevant traffic and reconstruct sessions to view higher-level activity. Encrypted traffic, such as HTTPS, may limit visibility to metadata unless the observer has legitimate access to keys or uses a controlled testing setup.

Typical uses include network troubleshooting, performance analysis, and capacity planning, as well as security monitoring and intrusion detection. They are also used in software debugging, malware analysis, and compliance reviews. Because sniffing can expose sensitive information such as login credentials, it is subject to legal and ethical constraints; capture generally requires authorization and must respect privacy laws and organizational policies.

Examples of widely used sniffing tools include Wireshark, a graphical packet analyzer, and tcpdump, a command-line packet collector. In addition, hardware network analyzers exist for temporally accurate, high-volume capture.