A sniffs B while B is sniffing C.
- What's the traffic in A? Does A catches both B and C traffic or only B's?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
It depends on how the network is set up and how they are sniffing.
With passive sniffing on a broadcast network, everybody sees everything. In particular, if B is doing a fairly standard sniff (e.g. default settings in tcpdump), then A not only sees all traffic from B and C, but can detect that B is sniffing through "leaked" DNS requests.
If the network is switched, sniffing is slightly harder. Assuming the switch is vulnerable to arp cache poisoning (arp spoofing), and A and B are non-privileged, then it could be tricky for A to reliably poison the cache for B while B is doing the same to C. It's likely that none of A, B, or C will be able to send or receive reliably.
On the other hand, if A is an administrator sniffing via a mirror of B's port, then A will see all of the traffic that B is receiving, which means A will also see C's traffic. And it will be obvious to A that B is performing an attack.
You can combine these scenarios too. Assume A and B are on a shared broadcast domain and C is on a different switch port. If B poisons the cache to receive C's traffic, then A can see all of that traffic. And again, the attack will probably be obvious to A. (This specific scenario is probably unlikely, but I've seen some odd setups.)
It may also be possible that B is the administrator and is inadvertently leaking a monitored port in a way that A can sniff it.
It depends how they are sniffing. If its just a broadcast network, like WiFi or a hub, then everyone sees each others traffic. If this was some kind of strange three way arp spoof, then yes, A could see both B and C's traffic. Although the ARP table would be very corrupt and B would probably see that something was wrong. However A could compensate for this strange three way sniff and try and repair the ARP table as B tries to damage it for its own ends.
You would still be on the same network.
A would get B only unless you were poisoning the entire subnet.
If you were using metasploit perhaps, you could use B as a pivot for anything you do to C...
I would suggest you learn the fundamentals of networking before you jump into sniffers, and subnets because, if its illegally performed then you would not be hard to catch.