Let's theoretically think we mirror the port on a ROUTER to a file. So the full network traffic on it.

Question: is it possible to still have communications on that wire (between the PC and the INTERNET) that will not be in the capture file?

To be more specific: Can the PC bypass the sniffing with ex.: using a new protocol?

The important thing is the traffic. Not that it is encrypted or not.

  • As to your specific question. No. The PC has no bypass to tell the router not to sniff. To the broader point of traffic not in a capture file. See @Johnny 's answer. Sep 16, 2016 at 19:34

4 Answers 4


Yes, but under very limited circumstances.

Under heavy loads SPAN ports are known to drop packets. Forced to make a choice between continuing to route/switch traffic or mirroring it to a second interface, the former will always take precedence.

It is entirely possible that a PCAP will not contain all the mirrored traffic you expect, but it is unlikely a user could deliberately bypass it unless they also flooded the device.

This is pretty much the use case we have for monitoring mainframe traffic. SPAN ports are not 100% reliable. Do not use mirroring if you need incontrovertible evidence of network activity. Buy a tap.

  • 1
    Also, although you hit on it, SPAN and mirrored ports will, depending on the implementation, not pass on malformed or dropped packets to their mirrored counterpart. As you said, mirrored ports aren't 100% reliable.
    – INV3NT3D
    Nov 15, 2016 at 19:59

No, the purpose of a sniffer is to capture all packets, unless a filter has been applied at capture time. Using a new protocol might mean the data can't automatically be rendered or analysed with more effort, but you will find they are all still saved to the file.

All the sniffer is doing is analysing captured data in the same way a router or gateway would do, the difference is it optionally records everything and doesn't automatically ignore malformed packets or packets it wouldn't normally be able to route anywhere.

Your best bet at hiding data from a sniffer is either to encrypt your data, or hide it amongst other common traffic.


Port mirroring (SPAN, RSPAN, RAP and so on) typically copies traffic at a packet level. You can only bypass it on a similar or lower network level. Depending on how mirroring is configured, this means you would have to use different physical layer connection (e.g. wireless hotspot) or route packets to bypass capture point (bridging, vlans).

Now, port mirroring would not magically decrypt your traffic. For example, if you create VPN tunnel and route all your traffic through it, such capture will be entirely useless in determining what is being sent, but it is still possible to determine endpoint you VPN to and how much data and when it was sent. If you use HTTPS, then it will be possible to determine what websites you visited, but not what you did there (e.g. checking gmail - they won't be able to read your email with just port mirroring). If you just use HTTP (e.g. posting on stack exchange), then it is possible to see in the packet capture not only that you visited here, but actually what you posted.


Ofcourse it can bypass the sniffer. He can always use a hotspot on his phone and thus you can not see the traffic from that PC at all. I dont know where you are looking for but this is always a possiblity...

  • OP is asking how to send traffic thru router but evade the sniffer.
    – ThoriumBR
    Sep 16, 2016 at 18:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.