Please explain how is it possible to sniff packets from within the datacenter.
Some background. I am studying networking options for DigitalOcean. My goal is to make sure that data exchange between hosts is secure as it may be sensitive. I read that DO's "private network" is not a real private network but instead includes all the users inside of the datacenter and isolates them from WAN.
Due to this, it is recommended to encrypt the connection between DigitalOcean's droplets that might exchange sensitive information.
I would like to better understand how is it possible to capture TCP/IP traffic that wasn't intended for your host within a reasonably secured and controlled environment of a datacenter (e.g. there's no WiFi, routing is properly configured, there's no malicious MITM possible).