What's the difference between MITM attack and sniffing? Also could anyone name a few other attacks similar to those?

5 Answers 5


It's sort of like asking the difference between a car and steering. When you are driving a car, you can (and probably should!) steer it. But you can steer a bike too...

Enough with the analogy, the difference, in my view, is that MitM is a class of attack and the sniffing is simply the word for analyzing packets on the network (and often just the packets going to/from your network card).

Once someone has become the "man" in a man-in-the-middle attack, they are able to sniff incoming/outgoing packets of their target.

Other related attacks/terms (to name a few) would be Arp Poisoning and DNS hijacking


Typically, an eavesdropper (sniffer) will be passive -- that is they will not modify the traffic.

Man-in-the-middle (MiTM) attacks usually imply an active adversary -- one who will change the contents of the message before passing it on.

The two are not entirely distinct, as a MiTM may use their active attack to read the contents of messages, or simply to disrupt communications.


A sniffing attack is a attack on confidentiality. It can be via a span port on a switch, processes on servers through which the traffic passes, on the end user client. Sniffing is often an MITM attack but it is passive.

A MITM attack is typically a more active attack where the traffic route has been altered to include the adversary, such as a rogue access point, or ARP/DNS poisoning, to allow a sniffing attack, break encryption, and/or tamper with the delivery of content (an integrity and confidentiality attack).

Once established as an active attack a MITM can hijack sessions, alter content to hide activity, inject malicious code, and depending on the service accessed perform sensitive functions. Some but not all of this is possible as a follow on from a passive sniffing attack using the information gathered.

Related / similar attacks are MiTB (man in the browser), keylogging, session hijacking, click jacking, and XSF.


The question should actually be "Difference between ARP Poisoning and Network Sniffing"

MITM attack can occur in both cases. Network sniffing is possible in each and every internal network and there is no other cure other than encryption or end point security. If you are on public wifi or untrusted network, you shouldn't be using unencrypted services over network or internet. For example an attacker can hijack your session within a network if you are surfing and logged into a non-https website.

While in ARP poisoning, attacker can even alter traffic because attacker's machine becomes the gateway of target machine. An example would be DNS spoofing via ARP poisoning. Since attacker's machine is the gateway of target, he can fake the DNS and resolve facebook.com to his own IP. He can then host a phishing page on his IP. So thats why whenever you visit facebook.com or others, you should check the greenlock on top. If you see some SSL error on https://www.facebook.com then it probably means someone is in the middle of you and facebook.com and you shouldn't force browser to proceed. ARP poisoning can be prevented and is mostly not possible in big organizations.


An attack can fit into multiple classifications at the same time.

In this case, these attacks both deal with captured network traffic between two hosts. The deciding factor is what's done with the captured data.

Man in the Middle (MITM)

Here network traffic is secretly captured and relayed between two hosts. If the data is not relayed to its intended recipient, then the attack is not a MITM attack, but rather a denial of service (DoS) attack. In fact, even if the data is relayed, but at suboptimal speeds, then the attack is both an MITM and a DoS attack.


This is the analysis of captured network traffic. If someone just analyzes captured traffic intended for his machine (with say Wireshark), that's just passive sniffing. If someone captures traffic with say, ARP poisoning, and then analyzes that traffic, then that becomes an active sniffing attack.

A word about ARP Poisoning

Strictly speaking, this just a preliminary step that allows for different types of follow-up attacks. Again, it depends what's done with the captured network traffic. If the traffic is not relayed to its intended target, you have a DoS attack. If it is, you have an MITM attack. If the traffic is also analyzed, then you additionally have a sniffing attack.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .