In promiscuous mode, a sniffer is able to read all data flowing into and out of a wireless access point. A wireless sniffing attack in monitor mode can be very difficult to detect because of this. In monitor mode, a wireless sniffer is able to collect and read incoming data without sending any data of its own.

There are two modes of wireless sniffing: monitor mode and promiscuous mode. Spoofing attacks often target business’ networks and can be used to steal sensitive information or run man-in-the-middle attacks against network hosts. Spoofing is a type of attack where a malicious party uses information obtained by a wireless sniffer to impersonate another machine on the network. Wireless sniffer tools are also commonly used in “spoofing” attacks. Wireless network sniffing attacks usually target unsecure networks, such as free WiFi in public places (coffee shops, hotels, airports, etc). Logins (usernames and passwords) are very common targets for attackers using wireless sniffer tools. Hackers can use wireless sniffer software to steal data, spy on network activity, and gather information to use in attacking the network. While wireless packet sniffers are valuable tools for maintaining wireless networks, their capabilities make them popular tools for malicious actors as well.

Wireshark packet sniffing detection