Penetration testing is one of the most interesting areas of cybersecurity. It allows security professionals to assess systems, identify weaknesses, understand potential attack paths and help organizations improve their defenses. For beginners, however, getting started can be confusing. You may have learned about network scanning, enumeration, vulnerability assessment, web security and penetration-testing tools. But where […]
Learning ethical hacking is very different from simply reading about cybersecurity. You can study what port scanning is, memorize vulnerability definitions and watch penetration-testing videos but eventually, you need a safe environment where you can actually practice. The problem is that you cannot legally practice hacking against random websites, servers or networks without permission. Fortunately, […]
If you’re learning ethical hacking, one of the biggest challenges is finding a safe environment where you can actually practice. Reading tutorials and watching videos can teach you the theory but hands-on practice is where cybersecurity concepts really start to make sense. The good news is that you don’t need an expensive enterprise setup to […]
Learning ethical hacking doesn’t require an expensive cybersecurity lab or a corporate network. With a computer, free software and a controlled environment, beginners can build a practical home lab where they can safely learn networking, vulnerability assessment, web security, enumeration and penetration testing. The most important rule is simple: only practice against systems you own […]
If you’re starting your cybersecurity journey, you’ve probably noticed there are thousands of tools available for use. Some are designed for network analysis, others focus on web application security, digital forensics, password auditing or incident response. Seeing so many options can be overwhelming. The good news is that you don’t need to learn every cybersecurity […]
Completed the Hack The Box “Helix” machine, a medium-difficulty Linux challenge focused on Apache NiFi and industrial control systems.
The attack chain involved virtual host discovery, Apache NiFi exploitation, reverse shell access as nifi, recovery of an SSH private key, and lateral movement to the operator user. Privilege escalation was achieved by interacting with the internal OPC UA server and manipulating reactor control values to open the privileged maintenance window, ultimately obtaining root access.
Another great HTB challenge combining web exploitation, credential recovery, Linux privilege escalation, and OT/ICS concepts.
If you’re new to ethical hacking, you’ve probably come across hundreds of cybersecurity tools. A quick search online reveals tools for network scanning, web application testing, password auditing, wireless security, digital forensics and much more. At first, this can feel overwhelming. Many beginners make the mistake of downloading dozens of tools without understanding what they […]
Network packet monitoring has long been an important skill for tech experts, especially those in cybersecurity. Like any skill, it demands a bit of studying and hands-on practice. While Wireshark has been a go-to tool for many, it can be somewhat cumbersome for beginners who simply want to see whom they’re exchanging data with. To simplify network monitoring, Sniffnet was developed.
In this article, we’ll dive into what Sniffnet is, how to install it, and provide a practical comparison of its features alongside those of Wireshark. Let’s get rolling!
What is Sniffnet?
Sniffnet is an open-source, cross-platform network monitoring tool developed in Rust. It captures and analyzes traffic flowing through a device’s network interfaces in real-time. Unlike traditional packet analyzers that typically display raw packet data, Sniffnet prioritizes visual clarity. It features a user-friendly dashboard that showcases live charts, protocol breakdowns, and geographic context instead of just a continuous stream of hex dumps.
Step #1: Installation
In this demonstration, I’ll be testing Sniffnet on Kali Linux, though it’s also cross-platform compatible with Windows and macOS. To get started with installation, we need to visit the official download webpage and choose the package. I’ll choose the DEB file. To install, just run the following command:
kali> sudo dpkg -i Sniffnet_LinuxDEB_amd64.deb
That’s it; we’re ready to start monitoring the traffic.
After starting the app, we need to choose the network adapter and click Start. If your system makes any network connections, you’ll see it as shown below.
The interface is straightforward. The screen is divided into blocks. At the top right, we can see the traffic rate. Beyond the live chart, Sniffnet also renders a donut chart showing cumulative statistics for the entire capture session. It tracks total incoming, outgoing, and dropped data.
Any packet sniffer can show you an IP address and a port number. Sniffnet goes further. The application can identify more than 6,000 upper-layer services, protocols, trojans, and worms flowing across your interface. Instead of staring at port 443 traffic and shrugging, Sniffnet can tell you the actual service behind that connection, in this case, HTTPS.
Besides that, every remote host your machine communicates with gets mapped to a physical location, so you can see at a glance whether your traffic is staying local or hopping across continents to servers you’ve never heard of. Beyond location, Sniffnet also pulls the Autonomous System Number and domain name associated with each host. Knowing the ASN tells you which organization or provider owns that piece of the internet. As you can see from the screenshot above, most requests were made to Cloudflare US servers. Nothing fancy, but it makes overall analysis much simpler for beginners.
The main page provides a very good overview of the network traffic. But when we find something valuable, let’s say an interesting host, we can click on it and see the whole communication history.
Practical Comparison: Sniffnet vs. Wireshark
Step 1: Getting an Overview of the Capture
When you load a pcap file into Sniffnet, it will immediately render the total traffic, direction split, and the donut chart of incoming, outgoing, and dropped data. In Wireshark, we can show this information too, but it takes navigating a menu and reading a table rather than seeing it visually on load. Pull up Statistics > Capture File Properties or Statistics > Protocol Hierarchy to get an equivalent summary.
Both tools can answer “what’s in this capture,” but one shows it, the other tells it.
Step 2: Finding the Suspicious Host
Let’s imagine that we want to view hosts by traffic volume.
As you can see in the screenshot above, at Sniffnet we need to change the data representation to packets, and that’s it. At Wireshark, we need to click Statistics > Endpoints > IPv4. Note that Wireshark has no built-in geolocation or ASN lookup, so you’d need a GeoIP database configured separately, or you’d have to pivot to an external tool like whois.
Step 3: Digging Into the Actual Conversation
Wireshark clearly stands out in this scenario. By simply right-clicking on the suspicious stream and selecting “Follow TCP Stream,” we can uncover the actual payload, which may include plaintext credentials, encoded commands, or unusual headers. For instance, in the case of the XWorm malware infection I examined, this Remote Access Trojan (RAT) encrypts commands sent from the Command and Control (C2) server using the AES encryption algorithm in ECB mode, making the payload unreadable. While we can see the ciphertext, Sniffnet lacks the capabilities to analyze it in this way. Sniffnet only presents connection metadata, service labels, and host details, as it isn’t designed for interpreting raw payloads. This underlines the importance of continuing to use Wireshark, even after Sniffnet performs the initial triage.
Step 4: Extracting Evidence
Since version 1.3, Sniffnet allows exporting the captured network traffic as a PCAP file. You can configure whether to export a capture file on the initial page of the app. By default, this functionality is not active, but you can enable it by clicking on the dedicated checkbox.
Wireshark offers a variety of flexible export options. You can save the entire packet capture in formats like PCAP, export only the packets you’ve selected, or even extract packet dissections as plain text. Additionally, you can choose to export specific protocol objects, such as HTTP files, or save the raw packet bytes.
Step 5: Filtering Down to What Matters
Sniffnet has built-in filtering options, filtering by IP address, port, protocol, or application layer service directly through the UI. This is menu-driven and requires no syntax to learn.
Wireshark has display filters, like ip.addr == 158.94.209.180 and tcp.port == 6000. Its filter syntax is far more expressive. You can chain logical operators, filter on specific packet fields deep inside a protocol, filter by string content inside payloads, or filter by flags. None of that granularity exists in Sniffnet.
Summary
When comparing Sniffnet and Wireshark, it’s clear that Sniffnet serves as a useful tool for monitoring network traffic, allowing you to keep tabs on your internet usage. It’s effective for gathering statistics and identifying your data exchange partners, but it falls short for more in-depth network investigations. On the other hand, Wireshark provides a much broader range of features for monitoring, filtering, and exporting traffic.
Therefore, if you’re just looking to casually check your traffic, Sniffnet will do the job. However, if you’re aiming to dive deeper and enhance your skills in network analysis, Wireshark is the way to go. Hackers-Arise offers a dedicated course titled “Wireshark for Cybersecurity” or you can opt for the Cybersecurity Starter Bundle, which includes this course along with 11 additional courses at a great price.
If you’re just starting your journey into ethical hacking, you’ve probably seen lists claiming there are hundreds of penetration testing tools you need to master. That can feel overwhelming. The good news is that you don’t need to learn every tool. Professional penetration testers often rely on a core set of trusted tools and choose […]
One of the most exciting moments for beginners entering cybersecurity is discovering ethical hacking tools. You install your first security-focused operating system, open a terminal, explore different applications and suddenly feel like you’ve entered a completely new world. However, there is one important lesson every beginner should understand: Tools do not make someone an ethical […]
The EU AI Act’s security requirements go beyond governance documentation and AI literacy training. High-risk AI systems need adversarial testing to prove they can withstand real attacks. Policies describe intent. Testing produces evidence. Security teams that add structured adversarial testing to their AI compliance programs will have something governance documentation alone cannot produce: demonstrated assurance. […]
Many beginners start learning ethical hacking with excitement. They install security tools, watch tutorials, create accounts on learning platforms and imagine themselves finding vulnerabilities like professional security researchers. But after a few weeks, reality often feels different. Suddenly there are hundreds of concepts: What looked exciting from the outside begins to feel confusing. Many beginners […]
If you’ve recently started learning ethical hacking, you’ve probably encountered countless videos, blog posts and social media content claiming that hacking is easy, exciting and something you can master in a few weeks. Unfortunately, much of this information is misleading. Movies, television shows and clickbait content have created unrealistic expectations about what ethical hacking actually […]
Starting a cybersecurity journey is exciting. You discover ethical hacking, penetration testing, digital forensics, threat hunting, malware analysis and dozens of other fascinating areas. Suddenly, a whole new world of technology opens up. Unfortunately, many beginners make mistakes that slow their progress, create unnecessary frustration or even push them away from cybersecurity altogether. The good […]
Login
