Network Sniffing Basics (scapy teaser)

By the end of this lesson you can:

• Explain what packet sniffing is and the legal boundaries (your own traffic only).
• Capture and inspect packets with scapy on your own loopback/network.
• See why plaintext HTTP leaks everything and HTTPS shows only ciphertext.
• Name the defences: TLS everywhere, switched networks, VPNs.

Data on a network is just electrical/radio signals anyone on the path can copy. On the same wifi or LAN segment, a sniffer can capture packets not addressed to it. If those packets are plaintext (HTTP, old FTP, Telnet), the contents — including passwords — are right there to read.

⚠️ The legal line (same as always, sharper here)

Capturing packets with scapy

from scapy.all import sniff, IP, TCP    # pip install scapy (run as admin/root)

# capture 10 packets on the loopback interface (your OWN local traffic)
def show(pkt):
    if pkt.haslayer(IP):
        ip = pkt[IP]
        proto = "TCP" if pkt.haslayer(TCP) else "other"
        print(f"{ip.src} → {ip.dst}  {proto} len={len(pkt)}")

sniff(iface="lo", count=10, prn=show)   # 'lo'/'lo0' = loopback = your own machine

sniff captures packets and calls your prn function on each. Filtering to your loopback (lo) keeps you watching only local, self-generated traffic. You can add a BPF filter="tcp port 8000" to focus.

The crux: plaintext vs. encrypted payloads

from scapy.all import sniff, Raw

def peek_payload(pkt):
    if pkt.haslayer(Raw):
        data = bytes(pkt[Raw].load)
        # HTTP is readable text; HTTPS/TLS is random-looking bytes
        try:
            text = data.decode("utf-8")
            print("PLAINTEXT:", text[:80])     # e.g. "POST /login ... password=hunter2"
        except UnicodeDecodeError:
            print("ENCRYPTED:", data[:24], "...(unreadable ciphertext)")

# sniff your own request to a LOCAL test server:
sniff(iface="lo", filter="tcp", count=20, prn=peek_payload)

This is the whole point. Send a request to a local plain-HTTP test server and the payload — including any form data — is readable text in the capture. Send it over HTTPS and the payload is unintelligible ciphertext. The sniffer sees the same packets; only encryption changes what it learns.

Defences against sniffing

• Encrypt everything in transit — TLS/HTTPS (Lesson 9), SSH instead of Telnet, SFTP instead of FTP. Then a sniffer gets only ciphertext.
• Switched networks — modern switches send frames only to the intended port (vs. old hubs that broadcast to all). But ARP spoofing (Lesson 4) can defeat this — so don't rely on it alone.
• VPNs — encrypt all traffic over untrusted networks (public wifi).
• Network monitoring — IDS that watches for the sniffing's precursors (e.g. ARP anomalies).

The legitimate defender uses

Sniffing isn't only an attack: defenders use it constantly — debugging why a connection fails, capturing traffic for an IDS, analysing malware's network behaviour in a sandbox, and verifying that your own app actually encrypts what it should. The skill is dual-use; the ethics decide which side you're on.

Goal: a controlled, local demonstration. Run a plain-HTTP and an HTTPS test server on localhost, send a request with a "password" to each, and sniff your own loopback to see one leak and one stay secret. Everything is your own traffic on your own machine.

# capture.py — run as admin/root; sniffs ONLY your loopback (your own traffic)
from scapy.all import sniff, Raw

SECRET_MARKER = b"password="

def inspect(pkt):
    if pkt.haslayer(Raw):
        data = bytes(pkt[Raw].load)
        if SECRET_MARKER in data:
            print("🔴 LEAKED on the wire:", data[:120].decode(errors="replace"))
        else:
            # likely TLS-encrypted application data
            head = data[:1]
            label = "TLS app-data" if head in (b"\x17",) else "binary"
            print(f"🔒 unreadable ({label}):", data[:16])

print("Sniffing loopback for 'password=' (your own traffic only)…")
# capture a small number of packets on loopback while you make the requests
sniff(iface="lo", filter="tcp", count=40, prn=inspect, store=False)

# in another terminal, send the SAME secret over HTTP then HTTPS to LOCAL servers
import requests

# (1) plain HTTP local server on :8000  → the sniffer will see the password
requests.post("http://127.0.0.1:8000/login", data={"password": "demo-pw"})

# (2) HTTPS local server on :8443 (self-signed lab cert, L8-09)
requests.post("https://127.0.0.1:8443/login",
              data={"password": "demo-pw"}, verify="cert.pem")

Sniffing loopback for 'password=' (your own traffic only)…
🔴 LEAKED on the wire: POST /login HTTP/1.1 ... password=demo-pw
🔒 unreadable (TLS app-data): b'\x17\x03\x03\x00@\x9a...'

Read the result

Side by side, the lesson is undeniable: the HTTP request's body — including password=demo-pw — appears in plaintext in the capture, while the HTTPS request shows only TLS application-data bytes (\\x17 records) that reveal nothing. The sniffer captured both equally; encryption is the only thing that protected the second. This is exactly why every login, every API, every page should be HTTPS — and why "it's just internal traffic" is a dangerous excuse. (Demo strictly on your own loopback; never sniff others.)

All capture is on your own loopback, on your own machine. If you can't run scapy (it needs privileges), Wireshark on a loopback capture demonstrates the same thing.

from scapy.all import sniff, TCP, UDP
from collections import Counter
tally = Counter()
def count(pkt):
    if pkt.haslayer(TCP): tally[f"tcp:{pkt[TCP].dport}"] += 1
    elif pkt.haslayer(UDP): tally[f"udp:{pkt[UDP].dport}"] += 1
sniff(count=100, prn=count, store=False)
print(tally.most_common(10))

A packet sniffer captures raw frames crossing an interface — a legitimate defender's tool and the threat that justifies encryption. Sniffing others' traffic is wiretapping and illegal; you only ever capture your own traffic on a network you control (loopback in your lab). The decisive demo: plaintext HTTP leaks everything (passwords included) into the capture, while HTTPS shows only TLS ciphertext — proving why everything must be encrypted in transit. Defences: TLS/HTTPS everywhere, SSH/SFTP over Telnet/FTP, VPNs on untrusted networks, switched networks (with ARP-spoofing caveats). scapy/Wireshark/tcpdump are the tools; the ethics decide the side.