# Eavesdropping attacks: how they work, types, detection and prevention

> What an eavesdropping attack is, passive vs active eavesdropping, the techniques used on networks, Wi-Fi and calls, and how to detect and prevent them.

- URL: https://computese.com/understanding-eavesdropping-attacks-how-they-work/
- Author: Duong Quan Nguyen, CEO, Computese
- Published: 2024-10-22
- Updated: 2026-09-25
- Topics: Security, IT support

## In short
- An eavesdropping attack is the unauthorized interception of communications, such as network traffic, Wi-Fi, calls or messages, usually without changing them, which is why it rarely sets off alarms.
- Passive eavesdropping only listens; active eavesdropping first moves the attacker into the path, with ARP spoofing, a rogue access point or a manipulator-in-the-middle proxy.
- Encryption in transit is the main defence: TLS 1.3 with HSTS, WPA3, VPNs or MACsec, and end-to-end encrypted messaging. Sniffed traffic that is encrypted end to end is noise.
- Detection looks for the setup rather than the listening: interfaces in promiscuous mode, new mirroring sessions, ARP anomalies, rogue access points and unexpected mail forwarding rules.

An eavesdropping attack is the unauthorized interception of communications, such as network traffic, Wi-Fi, phone and video calls, email or messages, so the attacker can read or record them. Most eavesdropping is passive: nothing is changed, nothing breaks, and the victim has no reason to look. That is what makes it effective, and why the defence is mostly about making intercepted data worthless rather than hoping to catch someone listening.

This guide explains how eavesdropping attacks work, the difference between passive and active eavesdropping, the main types and techniques, the methods used to detect them, and the controls that prevent eavesdropping on a data network. If you came here for the broader term, our explainer on [snooping in cyber security](https://computese.com/understanding-snooping-attacks-how-they-work/) covers how snooping, sniffing and eavesdropping relate.

## What is an eavesdropping attack?

In security terms, eavesdropping is a **passive attack**: one that "does not alter systems or data", in the definition [NIST's glossary](https://csrc.nist.gov/glossary/term/passive_attack) takes from CNSSI 4009. The [ITU-T's X.800 security architecture](https://www.itu.int/rec/T-REC-X.800-199103-I/en) describes passive threats the same way, as threats that would not modify any information, and gives observing data on a communications line as its example. Security teaching usually splits passive attacks in two:

- **Release of message contents:** reading what was sent, such as a password, a contract or a medical record.
- **Traffic analysis:** learning from the pattern of communication (who talks to whom, when, how often and how much) even when the content is encrypted. X.800 lists traffic padding among the protections against it.

The attacker needs only two things: a position where the traffic passes, and a way to make sense of it. A position can be physical (a cable, a switch port, a room), logical (a compromised router, a cloud account that can mirror traffic) or radio (anywhere within range of a Wi-Fi or Bluetooth signal).

What gets stolen is rarely the conversation for its own sake. It is credentials that unlock other systems, session cookies, invoices that can be altered for payment fraud, or intelligence gathered over months.

## Passive vs active eavesdropping

The line between the two is whether the attacker changes anything to get the data.

|                        | Passive eavesdropping                                                | Active eavesdropping                                                        |
| ---------------------- | -------------------------------------------------------------------- | --------------------------------------------------------------------------- |
| What the attacker does | Records traffic they can already see                                 | Changes routing, names or trust so traffic flows through them               |
| Typical techniques     | Packet sniffing, Wi-Fi monitoring, traffic analysis, recording audio | ARP spoofing, evil twin access points, DNS spoofing, SSL stripping, proxies |
| Trace left behind      | Almost none                                                          | Configuration changes, duplicate addresses, certificate warnings            |
| Main defence           | Encryption in transit                                                | Authentication of endpoints, plus encryption                                |

Active eavesdropping overlaps with the [manipulator-in-the-middle (MITM) attack](https://owasp.org/www-community/attacks/Manipulator-in-the-middle_attack), which MITRE ATT&CK tracks as [adversary-in-the-middle (T1557)](https://attack.mitre.org/techniques/T1557/). The attacker positions themselves between two parties, relays their traffic so nothing looks broken, and reads or alters it on the way. Our guide to [man-in-the-middle attacks](https://computese.com/understanding-man-in-the-middle-mitm-attacks/) covers that active side in depth, including phishing proxies that get past MFA.

## How an eavesdropping attack works

Whatever the medium, an attack runs through the same three stages.

1. **Get into position.** Join the same Wi-Fi, plug into a spare port, compromise a device on the path, or gain access to a cloud account. [MITRE notes](https://attack.mitre.org/techniques/T1040/) that attackers with network access can use switch port mirroring (SPAN) to see far more traffic, and in the cloud can use native features such as AWS Traffic Mirroring, Google Cloud Packet Mirroring or Azure virtual network TAP.
2. **Capture.** Put an interface into promiscuous mode and record with a packet sniffer such as Wireshark or tcpdump, the same tools administrators use every day, or run malware that captures keystrokes, audio or the screen on the endpoint itself.
3. **Extract.** Filter the capture for credentials, cookies, files and message content; crack captured password hashes offline; or build a picture from metadata when the content is encrypted.

One detail makes cloud and data-centre networks more exposed than they look: TLS often [ends at a load balancer or reverse proxy](https://computese.com/reverse-proxy/), and traffic behind it travels unencrypted between internal services. An attacker who can mirror that internal traffic sees it in the clear.

## Types of eavesdropping attacks

### Network sniffing on wired networks

On a modern switched network, a device only receives its own traffic, so an attacker has to change that first. The usual methods are ARP cache poisoning ([MITRE T1557.002](https://attack.mitre.org/techniques/T1557/002/)), where forged ARP replies make other hosts send their traffic to the attacker's MAC address, and abusing a mirroring port. Old protocols that send credentials in clear text, such as Telnet, FTP, HTTP, SNMPv1 and v2c, and POP3 or IMAP without TLS, turn a short capture into a list of passwords.

### Wi-Fi eavesdropping and evil twin access points

Radio does not stop at the wall. On an open network, anyone nearby can record unencrypted traffic. On a WPA2-Personal network, everyone who knows the shared password can, with some effort, decrypt each other's traffic, and a captured handshake lets an attacker try to guess a weak password offline.

An **evil twin** ([MITRE T1557.004](https://attack.mitre.org/techniques/T1557/004/)) is a rogue access point broadcasting the same network name (SSID) as a real one, often with a stronger signal, so phones and laptops join it and route everything through the attacker.

![Two identical Wi-Fi access points side by side. The orange one sends stronger signal arcs, a laptop and a phone connect to it, and their traffic flows on through it to the internet.](https://computese.com/images/blog/understanding-eavesdropping-attacks-how-they-work/twins.c6f5ebbcfb-1536.webp)

*Two access points, one network name. An evil twin copies the SSID of a real network so devices connect to the attacker instead.*

WPA3 raises the bar: WPA3-Personal resists offline password guessing, and [Protected Management Frames, which WPA3 requires](https://www.wi-fi.org/discover-wi-fi/security), protect management frames from eavesdropping and forging. On guest networks, Wi-Fi Enhanced Open encrypts traffic even without a password.

### Manipulator-in-the-middle and SSL stripping

An attacker in the middle can proxy HTTPS and present their own certificate, which a careful browser flags with a warning, or try to **strip** the connection down to plain HTTP when a user types a bare domain name. HTTP Strict Transport Security (HSTS, [RFC 6797](https://www.rfc-editor.org/rfc/rfc6797.html)) closes that gap by telling browsers to use HTTPS only for the site. A valid, current certificate is part of that defence, which is why [renewing SSL certificates on time](https://computese.com/ssl-certificate/) is a security task, not an admin chore.

### VoIP and video call eavesdropping

Voice over IP uses SIP to set up calls and RTP to carry audio. When RTP is not encrypted, anyone who captures the packets can reassemble the conversation. SRTP ([RFC 3711](https://www.rfc-editor.org/rfc/rfc3711.html)) encrypts the media, and SIP over TLS protects the signalling. Most business phone systems support both, but they are not always enabled, especially on older on-premises PBXs and cheap desk phones.

### Email, SMS and messaging interception

Email between servers is often protected only by opportunistic STARTTLS, which a downgrade can remove. The quieter technique is inside the mailbox: an attacker who briefly controls an account adds a **forwarding rule** that copies mail to an outside address ([MITRE T1114.003](https://attack.mitre.org/techniques/T1114/003/)), which keeps working after the password is reset.

Phone networks are a target too. [CISA's Mobile Communications Best Practice Guidance](https://www.cisa.gov/resources-tools/resources/mobile-communications-best-practice-guidance), first issued in December 2024 and revised since, responds to intrusions into commercial telecommunications infrastructure attributed to PRC-affiliated actors, which led to the theft of call records and the compromise of some private communications. Its first recommendation is to use only end-to-end encrypted communications, and it advises moving away from SMS-based multi-factor authentication.

### Malware, spyware and keyloggers

When the channel is well encrypted, attackers go to the endpoint, where data exists in the clear. Keyloggers, screen capture and microphone capture (MITRE T1056.001 and T1123) record information before it is ever encrypted. This is why endpoint protection and patching belong in any anti-eavesdropping plan.

### Acoustic and electromagnetic side channels

Some eavesdropping needs no network at all. In a [2023 study](https://arxiv.org/abs/2308.01074), researchers trained a model on the sound of laptop keystrokes and identified them with 95% accuracy from a nearby smartphone recording and 93% from a Zoom call. Electromagnetic emanations from screens and cables are the older version of the same idea, long studied under the name TEMPEST. For most organizations these are edge cases, but they are a reason not to type passwords while sharing audio on a call.

![An open laptop with a smartphone lying beside its keyboard. Orange sound waves rise from the keys into the phone's microphone, and the phone's screen shows an audio waveform.](https://computese.com/images/blog/understanding-eavesdropping-attacks-how-they-work/acoustic.f7aeba80ff-1536.webp)

*The keyboard is the leak: a phone on the same desk records the sound of each key, and a trained model identifies the keys from the recording.*

## Real-world examples of eavesdropping

- **Telecom interception at national scale.** The intrusions behind CISA's mobile guidance show that carrier networks themselves can be the eavesdropping point, which is why the guidance favours end-to-end encryption over trusting the network.
- **Business email compromise.** Forwarding rules and quiet mailbox access let attackers read invoice threads for weeks, then send a convincing request to change bank details. MITRE lists hidden forwarding rules as a known way to keep this access.
- **Public Wi-Fi.** Evil twins and open networks remain a practical way to capture traffic from travellers, which is why MITRE's mitigations include wireless intrusion prevention and teaching users to take certificate warnings seriously.
- **Keyboard acoustics.** The 2023 acoustic study is research, not an incident, but it shows how little equipment an attacker needs when a microphone is already on the desk.

## Methods of eavesdropping detection

Pure listening is close to invisible. Detection works because attackers have to set something up first, and those setup steps leave evidence.

| Where to look         | What to watch for                                                           | How                                                                                                      |
| --------------------- | --------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------- |
| Endpoints and servers | Capture tools running, interfaces switched to promiscuous mode, new drivers | EDR alerts, process and command-line logging                                                             |
| Switches and routers  | New SPAN or mirror sessions, duplicate IP-to-MAC mappings, ARP floods       | Configuration change alerts, Dynamic ARP Inspection, arpwatch                                            |
| Cloud accounts        | New traffic mirroring sessions or targets                                   | Cloud audit logs (for example, AWS CloudTrail) with alerts on mirroring APIs                             |
| Wireless              | Rogue or look-alike access points, deauthentication floods                  | Wireless intrusion detection or prevention (WIDS or WIPS)                                                |
| Mailboxes             | Forwarding rules to outside domains, hidden rules, unknown OAuth apps       | Mailbox rule audits, external forwarding blocked by policy                                               |
| Users                 | Certificate warnings on known sites, unexpected re-login prompts            | Clear reporting route to IT, security awareness training                                                 |
| Physical spaces       | Unknown devices on ports, hardware keyloggers, bugs                         | Port security, asset inventory, technical surveillance countermeasures (TSCM) sweeps for sensitive rooms |

> [!TIP]
> Treat any certificate warning on a site you use every day as a security event, not an annoyance. It is one of the few moments an active eavesdropper becomes visible to the person being targeted.

## How to prevent eavesdropping on a data network

The single most effective technique is **encryption of data in transit**, so that whatever an attacker captures is unreadable. The rest limits where an attacker can stand and what captured data is worth.

### For businesses

1. **Encrypt every connection.** Serve websites and APIs over [TLS 1.2 or 1.3](https://www.rfc-editor.org/rfc/rfc8446.html) only, with HSTS, and encrypt internal service-to-service traffic too, not just the public edge.
2. **Retire clear-text protocols.** Replace Telnet with SSH, FTP with SFTP, and move SNMP to v3, mail access to IMAP or POP3 over TLS, and DNS to DNS over TLS or HTTPS where your resolvers support it.
3. **Secure the wireless network.** Use WPA3-Enterprise with 802.1X for staff, a separate guest network with Wi-Fi Enhanced Open or WPA3, and wireless intrusion detection for rogue access points.
4. **Harden switches.** Enable port security, DHCP snooping and Dynamic ARP Inspection, and restrict who can create mirroring sessions. For links that leave your control, consider MACsec.
5. **Segment the network.** Keep payment, management and guest traffic in separate segments, so one foothold does not see everything.
6. **Make stolen credentials useless.** Enforce phishing-resistant multi-factor authentication (FIDO2 security keys or passkeys) so a sniffed password is not enough.
7. **Lock down email.** Block automatic forwarding to external domains, alert on new inbox rules and review third-party app permissions.
8. **Protect endpoints.** Patch quickly, run endpoint detection and response, and treat unknown USB devices as suspect.
9. **Encrypt calls and chat.** Enable SRTP and SIP over TLS on phone systems, and use end-to-end encrypted messaging for sensitive conversations.

### For individuals and remote workers

- Prefer mobile data or a trusted VPN on public Wi-Fi, and forget networks you no longer use so devices do not auto-join a look-alike.
- Check for HTTPS on any page that asks for a password, and never click through a certificate warning.
- Use a password manager and passkeys, and move off SMS codes where a service offers an app, a passkey or a security key.
- Keep your router's firmware updated, change its default admin password and use WPA3 if your devices support it.
- Mute your microphone before typing a password while you share audio on a call.

## Eavesdropping, snooping, sniffing and MITM compared

| Term                      | Meaning                                                           | Relationship to eavesdropping                             |
| ------------------------- | ----------------------------------------------------------------- | --------------------------------------------------------- |
| Eavesdropping             | Intercepting communications you are not part of                   | The umbrella for listening attacks                        |
| Snooping                  | Unauthorized access to data in general, in transit or at rest     | Broader: also covers reading files, screens and mailboxes |
| Sniffing                  | Capturing network packets with a sniffer                          | The main technical method of network eavesdropping        |
| Manipulator-in-the-middle | Relaying traffic between two parties while reading or altering it | Active eavesdropping, with the option to tamper           |
| Traffic analysis          | Inferring facts from metadata                                     | Works even against encrypted traffic                      |

If you are not sure where your own exposure is, our [security testing service](https://computese.com/services/security-testing/) checks the exposed surface an eavesdropper would start from: weak TLS settings, clear-text services and misconfigured email. For the day-to-day controls in the list above, from Wi-Fi to device patching, our [IT support](https://computese.com/services/it-support/) team runs them as part of looking after your people and devices.

## Key terms
- **Eavesdropping attack**: Intercepting communications you are not a party to, in order to read or record them. Also called sniffing or snooping when it targets network traffic.
- **Passive attack**: An attack that does not alter systems or data (CNSSI 4009). Eavesdropping and traffic analysis are the classic examples.
- **Traffic analysis**: Learning from the pattern of communications (who talks to whom, when and how much) even when the content is encrypted.
- **Packet sniffer**: Software such as Wireshark or tcpdump that captures network packets. Administrators use it to troubleshoot; attackers use it to harvest data.
- **Promiscuous mode**: A network interface setting that passes every frame the interface sees to the operating system, not only the frames addressed to it.
- **Manipulator-in-the-middle (MITM)**: An attacker who relays traffic between two parties while reading or changing it. Also called man-in-the-middle or adversary-in-the-middle.
- **Evil twin**: A rogue Wi-Fi access point that copies the name of a legitimate network so devices connect to it.
- **SRTP**: Secure Real-time Transport Protocol (RFC 3711), the encrypted form of the RTP streams that carry VoIP audio and video.
- **MACsec**: IEEE 802.1AE encryption between two directly connected Ethernet devices, which protects wired links against taps.

## Common questions

### What is an example of an eavesdropping attack?

A classic one is an attacker on a café's open Wi-Fi capturing traffic from nearby laptops and reading anything sent without encryption, such as a login to an old HTTP-only admin page. A current one is a compromised mailbox with a hidden rule that forwards every invoice email to an outside address.

### What technique can be used to prevent eavesdropping on a data network?

Encryption of data in transit. On the web that means TLS 1.2 or 1.3 with HSTS; on Wi-Fi, WPA3; between sites and for remote staff, a VPN such as IPsec or WireGuard; on wired links, MACsec. Network segmentation and multi-factor authentication limit what an eavesdropper can reach and reuse.

### What is the difference between passive and active eavesdropping?

Passive eavesdropping only records traffic the attacker can already see, so it leaves almost no trace. Active eavesdropping changes something first, such as poisoning ARP caches or luring devices to a fake access point, to get traffic routed through the attacker.

### Can eavesdropping be detected?

Pure listening is very hard to detect. What you can detect is how the attacker got into position: capture tools running, network interfaces switched to promiscuous mode, new port or cloud traffic mirroring, ARP anomalies, rogue access points, certificate warnings and suspicious mailbox rules.

### Does a VPN stop eavesdropping?

A VPN encrypts traffic between your device and the VPN endpoint, which protects you on untrusted Wi-Fi. It does not protect traffic after the endpoint, and it does not help if the device itself runs spyware. Use it alongside HTTPS, not instead of it.

## Sources
1. [Network Sniffing, Technique T1040](https://attack.mitre.org/techniques/T1040/), MITRE ATT&CK
2. [Adversary-in-the-Middle, Technique T1557](https://attack.mitre.org/techniques/T1557/), MITRE ATT&CK
3. [Adversary-in-the-Middle: ARP Cache Poisoning, T1557.002](https://attack.mitre.org/techniques/T1557/002/), MITRE ATT&CK
4. [Adversary-in-the-Middle: Evil Twin, T1557.004](https://attack.mitre.org/techniques/T1557/004/), MITRE ATT&CK
5. [Email Collection: Email Forwarding Rule, T1114.003](https://attack.mitre.org/techniques/T1114/003/), MITRE ATT&CK
6. [Glossary: passive attack](https://csrc.nist.gov/glossary/term/passive_attack), NIST Computer Security Resource Center
7. [X.800: Security architecture for Open Systems Interconnection for CCITT applications](https://www.itu.int/rec/T-REC-X.800-199103-I/en), ITU-T
8. [Mobile Communications Best Practice Guidance](https://www.cisa.gov/resources-tools/resources/mobile-communications-best-practice-guidance), CISA
9. [A Practical Deep Learning-Based Acoustic Side Channel Attack on Keyboards](https://arxiv.org/abs/2308.01074), arXiv (Harrison, Toreini, Mehrnezhad, 2023)
10. [RFC 8446: The Transport Layer Security (TLS) Protocol Version 1.3](https://www.rfc-editor.org/rfc/rfc8446.html), IETF
11. [RFC 6797: HTTP Strict Transport Security (HSTS)](https://www.rfc-editor.org/rfc/rfc6797.html), IETF
12. [RFC 3711: The Secure Real-time Transport Protocol (SRTP)](https://www.rfc-editor.org/rfc/rfc3711.html), IETF
13. [Wi-Fi security](https://www.wi-fi.org/discover-wi-fi/security), Wi-Fi Alliance
14. [Manipulator-in-the-middle attack](https://owasp.org/www-community/attacks/Manipulator-in-the-middle_attack), OWASP Foundation