We all know to use SSL/TLS to stop people eavesdropping on our connection, but how likely is it that an attacker will actually sniff your unencrypted password or cookie if you don't?
If we exclude sniffing on the local network (a pretty major exclusion I know, but indulge me), surely the attacker would need to have access to your ISP's servers, the server of the site you're connecting to, or one of the peering networks in between?

Has there ever been any research done on the incidence of this kind of attack?

  • 2
    The job of SSL/TLS is also to authenticate the server. Commented Jan 3, 2011 at 2:36
  • Is your question really just: "How likely is it that a packet you send will get sniffed somewhere other than your first hop?" They can sniff your packets whether you use SSL or not. Commented Jan 4, 2011 at 7:18
  • Firesheep in your local coffee shop springs to mind...
    – Rushyo
    Commented Jan 5, 2011 at 16:15

4 Answers 4


It depends on your threat model. If you're worried about big organizations who really really want to see your data, they're probably going to see it. The hardware and software to do this is generally available to ISPs since they're required by law to provide for "Lawful Intercept" in many jursidictions: http://en.wikipedia.org/wiki/Lawful_interception And unfortunately, the implementations by the router companies are pretty bad, as Forbes notes, so hackers may get access also.

Then there are all the other possible attacks, like DNS cache poisoning, phishing or routing (BGP) attacks, on connections that don't have the good endpoint authentication that SSL provides. See e.g. how the Dalai Lama's organization was hacked. Even security gurus figured they would be vulnerable to that kind of attack.

If no one (including insiders at your ISP or near your destinations) cares about you, you'll probably not be snooped on unless your local network is a convenient and easy target, like most wireless networks are. But if sufficiently savvy and persistent folks (even individuals) do care, beware.


It is definitely possible to sniff traffic on a network. Not to mention the different methods presented by the answers already here I would like to write about all the different equipment you are passing through when your connecting to someone on the internet.

Every single equipment you connect too has to be secured against attack, including having to trust that there is no rough insider on the equipment you connect through.

  • If someone is able to login to your ISP's Cisco router and redirect all your traffic through a MITM your are vulnerable
  • If there is a rough insider he can also listen in on all your unencrypted traffic

Please see How to own an ISP in 10 minutes for a proof of concept.


DNS spoofing/cache poisoning/etc. are also techniques to facilitate MiTM (especially when partnered with sslstrip). ARP spoofing/poisoning is of course popular (this a LAN based attack so maybe it’s excluded given your question).

"How likely" to me is the hard part of your question. If you have something of value it’s possible someone will spend the time to see if they can trick you for their advantage.

Opportunistic attackers seem to play more around wireless networks or other shared networks (unless they can easily commandeer your home router/modem, for example).


Assuming you trust your connection, I'd imagine the chances of this happening are pretty tiny. Basically, it would need to happen either at your ISP (maybe a misconfguration there sends your traffic to all customers on the same 'node' as you) or the remote end (maybe a misconfigured switch broadcasts traffic to one server to all the ones on the same switch).

I can't really picture that any of the major tier 1 networks have any ability to sniff your traffic. At the speeds they are seeing, it would require some pretty beefy hardware.

  • 1
    the ISP's do have the ability. What they don't want is the responsibility - if they admit to being able to check content, they will be forced to change from 'common carrier' to 'provider' in many jurisdictions - bad news for them from a cost and liability perspective.
    – Rory Alsop
    Commented Jan 3, 2011 at 13:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .