The principle and tools of LAN sniffing

Sniffing can only occur on a local area network where communication is addressed through a MAC address, which occurs over the LAN through IP addressing.

ARP protocol, in computer A will send an ARP broadcast to find the communication object Computer B's MAC address, if there is a computer C, impersonate both sides of the IP, and send their own Mac to A and C, you can implement packet forwarding, and then implement sniffing or monitoring. This is the principle of LAN sniffing.

Arp-a can view the ARP table, the static table in the ARP table is higher than the dynamic table priority, you can bind the static table by Arp-s IP mac.

Schematic diagram

The principle and tools of LAN sniffing