# Can you detect someone sniffing traffic on our network?

Usually not directly. Passive sniffing, a device that only listens, sends nothing and so leaves almost nothing to detect. What you can detect is the work an attacker has to do to see traffic that is not meant for them. On a switched network they must redirect it, for example with ARP spoofing, or plug into a mirror port, a hub or a tap. Switch features such as dynamic ARP inspection and DHCP snooping block the redirection, port security limits who can plug in, and encrypting internal services with HTTPS, SSH and SMB encryption makes captured traffic far less useful. A sensor watching the segment sees unusual ARP announcements and the new device that starts talking; a listener that stays completely silent is invisible to NetSenX, as it is to any network sensor.

FAQ: [Have I been hacked?](https://netsenx.com/en/faq/signs) · https://netsenx.com/en/faq/can-you-detect-someone-sniffing-traffic-on-the-network

## Read next

- https://netsenx.com/en/is-someone-inside-your-network
- https://netsenx.com/en/detect-lateral-movement-c2-beaconing

## Related questions

- [Can a hacker on our network steal data from all our computers and servers?](https://netsenx.com/en/faq/can-a-hacker-on-our-network-steal-data-from-every-computer)
- [How does an attacker get from our public IP address into our internal machines?](https://netsenx.com/en/faq/how-does-an-attacker-get-from-our-public-ip-to-internal-machines)
- [Are printers, cameras and other office devices a way in for attackers?](https://netsenx.com/en/faq/are-printers-and-cameras-a-way-in-for-attackers)
- [Is our smart TV or conference room system a security risk on the office network?](https://netsenx.com/en/faq/is-our-smart-tv-or-conference-system-a-security-risk)
- [A login from a new location: is it a breach or an employee on a new device?](https://netsenx.com/en/faq/login-from-a-new-location-breach-or-new-device)