Sniffing, by definition, is using our sense of smell to savor something, like a sniff of perfume. In this case, our nose acts as a sniffer. We can perform sniffing on the network using various tools categorized as packet sniffers to capture or collect the packets flowing in our networks. They are simply a way for us to see the network traffic and bandwidth information over the entire IT infrastructure. The technique of using a packet sniffer to sniff the data flowing over the wire or through thin air (wireless) is called packet sniffing.
Packet sniffing is performed in order to better understand what flows through our networks. Just as a poison flowing through the veins of the human body has the potential to kill an individual, similarly malicious traffic traversing our networks can have a severe and sometimes irreparable effect on the network devices, performance, and business continuity.
Sniffing helps a network analyst verify whether the implementation and functionality of the network and network security devices, such as the router, switch, firewall, IDS, or IPS, are as expected and also confirms that data is traversing through secure channels of communication.
Security analysts use sniffing to gather evidence in the case of a security breach with regard to the source of the attack, time and duration of the attack, protocols and port numbers involved, and data transmitted for the purpose of the attack. It can also help to prove the use of any insecure protocol(s) used to transmit sensitive information.
As Christopher Hitchens, a British-born American author, was once quoted saying:
"That which can be asserted without evidence, can be dismissed without evidence."
Using a packet sniffer helps us get that piece of evidence.
Now, to figure out whether the smell of the perfume is pleasant, ambrosial, or reeking is the analysis part. Hence, the art of interpreting and analyzing packets flowing through the network is known as packet analysis or network analysis. Mastering this art is a well-honed skill and can be achieved if a network administrator has a solid understanding of the TCP/IP protocol suite, is familiar with packet flows, and has an excellent grasp of any sniffer of choice.
Learning technology at the packet level helps to cement the most difficult concepts. For an easy example, let's say that a user wants to browse a website named example.com. As soon as the user enters the URL in the address bar and hits GO, the packets start to flow on the network with respect to that request. To understand this packet flow, we need to start sniffing to look at the packets in transit. The following screenshot shows the packets that traversed the network when the user opened example.com.
We can analyze the packets after capturing them using a sniffer of choice, and in our case, we notice the columns that tell us about the source and destination IP addresses, the protocol being used, the length of the individual packets, and other relevant information. We will be digging into more detailed analysis as we progress though this book.
When we talk about enterprise networks, at any given point, there is humongous amount of traffic on the wire and analyzing such traffic is not a walk in the park. This traffic may be generated by numerous network devices communicating among each other, servers responding to user requests, or making their own requests over the Internet when required, and end users trying to accomplish their day-to-day tasks at work. There is no better way to understand this flow of information than to perform a packet-level analysis and, as the famous quote about network analysis goes, packets never lie. In addition, Gerald Combs, the man behind Wireshark, once tweeted the following:
""The packets never lie" but as traffic volumes increase you end up with a trillion truths. The trick is finding the important ones."
Learning such tricks comes only with experience, as with anything else in the field of IT. As an example, if you want to improve your programming skills, you have to practice code writing day in and day out to be able to write structured and optimized pieces of code that can perform magic. The same goes for packet analysis.
Packet analysis can further help an administrator to:
Monitor and provide a detailed statistics of activities on the network
Distinguish between normal and unusual traffic
Perform network diagnostics
Identify and resolve network performance issues such as excessive bandwidth utilization
Conduct deep packet inspection
Investigate security breaches