Snooping in cyber security is unauthorized access to someone else's data. It covers reading network traffic you are not meant to see, opening files or records without a reason, reading another person's email or messages, and looking at information on a screen. A snooping attack does not have to break anything: the damage is that private information stops being private, often without anyone noticing.
This explainer covers what snooping means in cyber security, networking, cryptography and computer hardware, the common types of snooping attacks and how they work, how snooping differs from eavesdropping, sniffing and spoofing, and the controls that prevent it.
What does snooping mean in cyber security?
Security professionals group threats by what they damage: confidentiality, integrity or availability, the "CIA triad". Snooping is a threat to confidentiality. The attacker reads, copies or watches data; they do not need to change it, and systems keep running normally.
Snooping ranges from the casual to the technical:
- Casual: reading an unlocked screen, glancing over a shoulder on a train, opening a colleague's files on a shared drive.
- Technical: capturing packets on a network, installing a keylogger, planting a forwarding rule in a mailbox, querying a DNS server to learn what its users visit.
What separates snooping from legitimate monitoring is authorization. A security team inspecting traffic under a written policy is monitoring; an administrator reading an executive's inbox out of curiosity is snooping, even though both have the technical access.
Snooping in cryptography and network security
Many cryptography and network security courses teach a classic taxonomy of attacks, grouped by the security goal they threaten:
| Security goal | Attacks that threaten it |
|---|---|
| Confidentiality | Snooping, traffic analysis |
| Integrity | Modification, masquerading, replaying, repudiation |
| Availability | Denial of service |
The ITU-T X.800 security architecture, which much of this teaching builds on, calls these passive threats: threats that, if realized, would not modify any information, with observing data on a communications line as the example. NIST's glossary defines a passive attack the same way, as one that "does not alter systems or data."
The distinction matters in practice. Encryption defeats content snooping: a captured TLS 1.3 session is unreadable without the keys. Encryption alone does not defeat traffic analysis: an observer can still see which servers you connect to, when, and how much data moves. Hiding that takes extra measures, such as encrypted DNS, VPNs or padding, and it is why metadata is valuable to attackers and intelligence services alike.
Types of snooping attacks
Network snooping (packet sniffing)
Network snooping means capturing traffic with a sniffer, the NIST term for a program that captures data across a network. Wireshark and tcpdump are the everyday examples: indispensable for administrators, equally useful to an attacker. On switched networks the attacker first needs a vantage point, such as a mirrored port or an ARP spoofing position; MITRE ATT&CK tracks the whole technique as Network Sniffing (T1040). Anything sent in clear text, such as HTTP, FTP, Telnet or old mail protocols, is readable.
Wi-Fi snooping
Wireless traffic can be received by anyone in range. Open hotspots expose everything that is not encrypted by the application itself, and look-alike "evil twin" networks trick devices into routing all traffic through an attacker, the opening move of a man-in-the-middle attack. The U.S. Federal Trade Commission notes that most websites now encrypt traffic, which makes public Wi-Fi usually safe for them, and advises checking for HTTPS in the address bar. The exposure that remains is anything the site or app does not encrypt itself.
DNS snooping
Every visit to a website usually starts with a DNS query, and classic DNS is not encrypted, so anyone on the path can see which domains a device looks up. DNS cache snooping is a subtler variant: by querying a shared resolver without asking it to recurse, an attacker learns whether a domain is already in its cache, and so whether someone on that network visited it recently. Encrypted DNS (DNS over HTTPS, RFC 8484, and DNS over TLS, RFC 7858) and resolvers that refuse outside queries close both gaps.
Email and account snooping
The quiet approach is to read data where it rests. An attacker, or an insider, with brief access to a mailbox can add a rule that forwards copies of every message to an outside address (MITRE T1114.003), and it keeps working after the password is changed. Third-party apps granted permission to read mail, and linked devices in messaging apps, are the same risk in a different form. CISA's mobile guidance tells high-risk users to check the linked devices list in their messaging apps and remove anything they do not recognize.
Device snooping: keyloggers, screens and stalkerware
On the endpoint, data exists before it is encrypted. Software keyloggers and hardware keyloggers (small adapters between a keyboard and the computer) record typing, screen capture tools record what is shown, and stalkerware on phones forwards messages and location. MITRE tracks keylogging as T1056.001.
Insider snooping
Some of the most damaging snooping is done by people with legitimate access: staff who look up records of neighbours, celebrities or ex-partners in systems they use for work. It is common enough in healthcare, finance and telecoms that access logging and regular reviews are standard controls there. Technical access is not the same as authorization, and logs are how an organization can tell the difference.
How a snooping attack works
A typical attack follows four quiet steps. In this example, a small company is the target:
- Access. An attacker phishes one employee's email password. The account has no multi-factor authentication.
- Persistence. Instead of doing anything noisy, the attacker adds a mailbox rule forwarding messages containing "invoice" or "payment" to an outside address, and marks them as read.
- Collection. For weeks, the attacker reads supplier conversations, learns names, amounts and payment schedules, and watches for the right moment.
- Use. The attacker sends a well-timed message asking finance to update a supplier's bank details, a business email compromise built entirely on what snooping revealed.
Nothing in that sequence triggers an antivirus alert. Detection depends on someone looking at mailbox rules, sign-in locations and unusual forwarding, which is why the prevention list below leans on configuration and review as much as on software.
When "snooping" is not an attack: DHCP, IGMP and bus snooping
If you searched for "snooping in networking" or "snooping in computer" you may have met the word in a completely different sense. Three common technical features carry the name, and none of them is an attack.
- DHCP snooping is a switch security feature. You mark the ports that lead to real DHCP servers as trusted; the switch then drops DHCP server replies arriving on any other port, which stops rogue DHCP servers from sending devices to an attacker's gateway or DNS server. The switch also builds a binding table of which IP address each device received, and features such as Dynamic ARP Inspection and IP Source Guard use it to drop spoofed traffic. In other words, DHCP snooping is a defence against network snooping.
- IGMP snooping (and MLD snooping for IPv6) lets a switch listen to multicast membership messages, so a video stream or market-data feed goes only to the ports whose devices asked for it, instead of flooding every port. RFC 4541 describes how snooping switches should behave.
- Bus snooping is a hardware technique in multicore processors. Each core's cache watches (snoops) the shared bus or interconnect for writes to memory it has cached, and invalidates or updates its copy, so no core computes with stale data. Protocols such as MESI are built on it.
Snooping vs eavesdropping, sniffing and spoofing
| Term | What it means | How it relates to snooping |
|---|---|---|
| Snooping | Unauthorized access to data, in transit or at rest | The umbrella term |
| Eavesdropping | Intercepting live communications | Snooping on data in transit, such as calls, messages and network traffic |
| Sniffing | Capturing packets with a sniffer | A technical method of network snooping |
| Spoofing | Pretending to be another device or person | Often the step that makes active snooping possible, such as ARP or DNS spoofing |
| Traffic analysis | Learning from metadata | Snooping that works even against encrypted traffic |
For the interception side in depth, including passive and active techniques and how to detect them, read our guide to eavesdropping attacks.
Signs someone may be snooping
- Sign-in alerts or sessions from places or devices you do not recognize.
- Email forwarding rules, filters or delegates you did not set up.
- Unknown devices in the "linked devices" list of WhatsApp, Signal or similar apps.
- Third-party apps with permission to read your mail, files or contacts.
- Certificate warnings on websites you use every day.
- On phones: unexplained battery drain, data use or a device that stays warm when idle, which can point to stalkerware.
- On networks: interfaces in promiscuous mode, new port mirroring sessions, or a DHCP server that should not exist.
How to prevent snooping
For organizations
- Encrypt data in transit and at rest. TLS everywhere (with HSTS on websites), encrypted DNS where supported, and full-disk encryption such as BitLocker or FileVault on every laptop.
- Grant least privilege, and log access. People should reach only the records their role needs, and access to sensitive data should be logged and reviewed. Reviews are what deter insider snooping.
- Use phishing-resistant MFA. FIDO2 security keys or passkeys stop most of the account takeovers that email snooping starts from.
- Block external auto-forwarding and alert on new inbox rules and newly consented mail apps.
- Harden the network. Enable DHCP snooping, Dynamic ARP Inspection and port security on switches, use 802.1X for wired and wireless access, WPA3 on Wi-Fi, and restrict who can configure mirroring.
- Protect endpoints. Keep devices patched, run endpoint detection and response, lock screens automatically, and check shared machines for unknown USB devices.
- Train people for the low-tech cases. Privacy filters on laptops used in public, screen locking, and a clear way to report something odd.
For individuals
- Use a password manager and turn on multi-factor authentication, preferably with passkeys or a security key.
- Review linked devices, forwarding rules and connected apps in your main accounts every few months.
- Avoid entering personal information on public Wi-Fi unless the site uses HTTPS, and never click through a certificate warning.
- Keep your phone's operating system updated and install apps only from official stores.
- Lock your devices, and do not leave them unlocked and unattended.
If you want these controls set up and kept up for your team, our IT support service covers device, account and network hygiene day to day, and our security scanning shows what an outsider could see and reach from the internet.
