A sniffs B while B is sniffing C.

  • What's the traffic in A? Does A catches both B and C traffic or only B's?

It depends on how the network is set up and how they are sniffing.

Broadcast Network - Passive

With passive sniffing on a broadcast network, everybody sees everything. In particular, if B is doing a fairly standard sniff (e.g. default settings in tcpdump), then A not only sees all traffic from B and C, but can detect that B is sniffing through "leaked" DNS requests.

Switched Network - Arp Cache Poisoning

If the network is switched, sniffing is slightly harder. Assuming the switch is vulnerable to arp cache poisoning (arp spoofing), and A and B are non-privileged, then it could be tricky for A to reliably poison the cache for B while B is doing the same to C. It's likely that none of A, B, or C will be able to send or receive reliably.

Switched Network - Mirroring

On the other hand, if A is an administrator sniffing via a mirror of B's port, then A will see all of the traffic that B is receiving, which means A will also see C's traffic. And it will be obvious to A that B is performing an attack.


You can combine these scenarios too. Assume A and B are on a shared broadcast domain and C is on a different switch port. If B poisons the cache to receive C's traffic, then A can see all of that traffic. And again, the attack will probably be obvious to A. (This specific scenario is probably unlikely, but I've seen some odd setups.)

It may also be possible that B is the administrator and is inadvertently leaking a monitored port in a way that A can sniff it.

  • 1
    Now, C is sniffing A while the NSA is sniffing all of them. What happens now? – KnightOfNi Jun 5 '14 at 1:48
  • @KnightOfNi Is A, C, and NSA the names of Dogs? – Insane Jan 25 '16 at 11:21

It depends how they are sniffing. If its just a broadcast network, like WiFi or a hub, then everyone sees each others traffic. If this was some kind of strange three way arp spoof, then yes, A could see both B and C's traffic. Although the ARP table would be very corrupt and B would probably see that something was wrong. However A could compensate for this strange three way sniff and try and repair the ARP table as B tries to damage it for its own ends.


You would still be on the same network.

A would get B only unless you were poisoning the entire subnet.

If you were using metasploit perhaps, you could use B as a pivot for anything you do to C...

I would suggest you learn the fundamentals of networking before you jump into sniffers, and subnets because, if its illegally performed then you would not be hard to catch.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.