# What is snooping in cyber security? Snooping attacks explained

> Snooping is unauthorized access to someone else's data. See the types of snooping attacks, what snooping means in networking and computing, and how to stop it.

- URL: https://computese.com/understanding-snooping-attacks-how-they-work/
- Author: Duong Quan Nguyen, CEO, Computese
- Published: 2024-10-21
- Updated: 2026-09-25
- Topics: Security, IT support

## In short
- In cyber security, snooping is unauthorized access to someone else's data: reading traffic on a network, files on a device, messages in a mailbox or information on a screen.
- Snooping is a threat to confidentiality. Encryption stops attackers reading content, but traffic analysis of metadata can still reveal who talks to whom and when.
- In networking and hardware, the word also names legitimate features: DHCP snooping and IGMP snooping on switches, and bus snooping that keeps CPU caches coherent.
- Prevention combines encryption, least-privilege access with audit logs, phishing-resistant MFA, switch protections such as DHCP snooping, and checks for the quiet signs, such as unknown forwarding rules or linked devices.

Snooping in cyber security is unauthorized access to someone else's data. It covers reading network traffic you are not meant to see, opening files or records without a reason, reading another person's email or messages, and looking at information on a screen. A snooping attack does not have to break anything: the damage is that private information stops being private, often without anyone noticing.

This explainer covers what snooping means in cyber security, networking, cryptography and computer hardware, the common types of snooping attacks and how they work, how snooping differs from eavesdropping, sniffing and spoofing, and the controls that prevent it.

## What does snooping mean in cyber security?

Security professionals group threats by what they damage: confidentiality, integrity or availability, the "CIA triad". Snooping is a **threat to confidentiality**. The attacker reads, copies or watches data; they do not need to change it, and systems keep running normally.

Snooping ranges from the casual to the technical:

- **Casual:** reading an unlocked screen, glancing over a shoulder on a train, opening a colleague's files on a shared drive.
- **Technical:** capturing packets on a network, installing a keylogger, planting a forwarding rule in a mailbox, querying a DNS server to learn what its users visit.

What separates snooping from legitimate monitoring is **authorization**. A security team inspecting traffic under a written policy is monitoring; an administrator reading an executive's inbox out of curiosity is snooping, even though both have the technical access.

## Snooping in cryptography and network security

Many cryptography and network security courses teach a classic taxonomy of attacks, grouped by the security goal they threaten:

| Security goal   | Attacks that threaten it                           |
| --------------- | -------------------------------------------------- |
| Confidentiality | Snooping, traffic analysis                         |
| Integrity       | Modification, masquerading, replaying, repudiation |
| Availability    | Denial of service                                  |

The [ITU-T X.800 security architecture](https://www.itu.int/rec/T-REC-X.800-199103-I/en), which much of this teaching builds on, calls these passive threats: threats that, if realized, would not modify any information, with observing data on a communications line as the example. [NIST's glossary defines a passive attack](https://csrc.nist.gov/glossary/term/passive_attack) the same way, as one that "does not alter systems or data."

The distinction matters in practice. **Encryption defeats content snooping:** a captured TLS 1.3 session is unreadable without the keys. **Encryption alone does not defeat traffic analysis:** an observer can still see which servers you connect to, when, and how much data moves. Hiding that takes extra measures, such as encrypted DNS, VPNs or padding, and it is why metadata is valuable to attackers and intelligence services alike.

## Types of snooping attacks

### Network snooping (packet sniffing)

Network snooping means capturing traffic with a sniffer, [the NIST term](https://csrc.nist.gov/glossary/term/sniffer) for a program that captures data across a network. Wireshark and tcpdump are the everyday examples: indispensable for administrators, equally useful to an attacker. On switched networks the attacker first needs a vantage point, such as a mirrored port or an ARP spoofing position; MITRE ATT&CK tracks the whole technique as [Network Sniffing (T1040)](https://attack.mitre.org/techniques/T1040/). Anything sent in clear text, such as HTTP, FTP, Telnet or old mail protocols, is readable.

### Wi-Fi snooping

Wireless traffic can be received by anyone in range. Open hotspots expose everything that is not encrypted by the application itself, and [look-alike "evil twin" networks](https://www.cisa.gov/news-events/news/securing-wireless-networks) trick devices into routing all traffic through an attacker, the opening move of a [man-in-the-middle attack](https://computese.com/understanding-man-in-the-middle-mitm-attacks/). The U.S. Federal Trade Commission notes that [most websites now encrypt traffic](https://consumer.ftc.gov/articles/are-public-wi-fi-networks-safe-what-you-need-know), which makes public Wi-Fi usually safe for them, and advises checking for HTTPS in the address bar. The exposure that remains is anything the site or app does not encrypt itself.

### DNS snooping

Every visit to a website usually starts with a DNS query, and classic DNS is not encrypted, so anyone on the path can see which domains a device looks up. **DNS cache snooping** is a subtler variant: by querying a shared resolver without asking it to recurse, an attacker learns whether a domain is already in its cache, and so whether someone on that network visited it recently. Encrypted DNS (DNS over HTTPS, [RFC 8484](https://www.rfc-editor.org/rfc/rfc8484.html), and DNS over TLS, [RFC 7858](https://www.rfc-editor.org/rfc/rfc7858.html)) and resolvers that refuse outside queries close both gaps.

### Email and account snooping

The quiet approach is to read data where it rests. An attacker, or an insider, with brief access to a mailbox can add a rule that forwards copies of every message to an outside address ([MITRE T1114.003](https://attack.mitre.org/techniques/T1114/003/)), and it keeps working after the password is changed. Third-party apps granted permission to read mail, and linked devices in messaging apps, are the same risk in a different form. [CISA's mobile guidance](https://www.cisa.gov/resources-tools/resources/mobile-communications-best-practice-guidance) tells high-risk users to check the linked devices list in their messaging apps and remove anything they do not recognize.

### Device snooping: keyloggers, screens and stalkerware

On the endpoint, data exists before it is encrypted. Software keyloggers and hardware keyloggers (small adapters between a keyboard and the computer) record typing, screen capture tools record what is shown, and stalkerware on phones forwards messages and location. MITRE tracks [keylogging as T1056.001](https://attack.mitre.org/techniques/T1056/001/).

![A keyboard cable plugs into a small orange adapter in the back of a desktop computer. Each keystroke passes through the adapter, which keeps a copy of it.](https://computese.com/images/blog/understanding-snooping-attacks-how-they-work/keylogger.39e15b4de9-1536.webp)

*A hardware keylogger sits between the keyboard and the computer and records every keystroke. Check the back of shared machines.*

### Insider snooping

Some of the most damaging snooping is done by people with legitimate access: staff who look up records of neighbours, celebrities or ex-partners in systems they use for work. It is common enough in healthcare, finance and telecoms that access logging and regular reviews are standard controls there. Technical access is not the same as authorization, and logs are how an organization can tell the difference.

## How a snooping attack works

A typical attack follows four quiet steps. In this example, a small company is the target:

1. **Access.** An attacker phishes one employee's email password. The account has no multi-factor authentication.
2. **Persistence.** Instead of doing anything noisy, the attacker adds a mailbox rule forwarding messages containing "invoice" or "payment" to an outside address, and marks them as read.
3. **Collection.** For weeks, the attacker reads supplier conversations, learns names, amounts and payment schedules, and watches for the right moment.
4. **Use.** The attacker sends a well-timed message asking finance to update a supplier's bank details, a business email compromise built entirely on what snooping revealed.

Nothing in that sequence triggers an antivirus alert. Detection depends on someone looking at mailbox rules, sign-in locations and unusual forwarding, which is why the prevention list below leans on configuration and review as much as on software.

## When "snooping" is not an attack: DHCP, IGMP and bus snooping

If you searched for "snooping in networking" or "snooping in computer" you may have met the word in a completely different sense. Three common technical features carry the name, and none of them is an attack.

![A network switch whose uplink port, joined by an orange cable to the real DHCP server, is trusted. Addresses flow down to three laptops, while replies from a rogue server on another port are blocked.](https://computese.com/images/blog/understanding-snooping-attacks-how-they-work/switch.d392b7b7c6-1536.webp)

*DHCP snooping trusts only the uplink port to answer DHCP requests. A rogue DHCP server plugged into any other port is ignored.*

- **DHCP snooping** is a switch security feature. You mark the ports that lead to real DHCP servers as trusted; the switch then drops DHCP server replies arriving on any other port, which stops rogue DHCP servers from sending devices to an attacker's gateway or DNS server. The switch also builds a binding table of which IP address each device received, and features such as Dynamic ARP Inspection and IP Source Guard use it to drop spoofed traffic. In other words, DHCP snooping is a defence against network snooping.
- **IGMP snooping** (and MLD snooping for IPv6) lets a switch listen to multicast membership messages, so a video stream or market-data feed goes only to the ports whose devices asked for it, instead of flooding every port. [RFC 4541](https://www.rfc-editor.org/rfc/rfc4541.html) describes how snooping switches should behave.
- **Bus snooping** is a hardware technique in multicore processors. Each core's cache watches (snoops) the shared bus or interconnect for writes to memory it has cached, and invalidates or updates its copy, so no core computes with stale data. Protocols such as MESI are built on it.

## Snooping vs eavesdropping, sniffing and spoofing

| Term             | What it means                                      | How it relates to snooping                                                      |
| ---------------- | -------------------------------------------------- | ------------------------------------------------------------------------------- |
| Snooping         | Unauthorized access to data, in transit or at rest | The umbrella term                                                               |
| Eavesdropping    | Intercepting live communications                   | Snooping on data in transit, such as calls, messages and network traffic        |
| Sniffing         | Capturing packets with a sniffer                   | A technical method of network snooping                                          |
| Spoofing         | Pretending to be another device or person          | Often the step that makes active snooping possible, such as ARP or DNS spoofing |
| Traffic analysis | Learning from metadata                             | Snooping that works even against encrypted traffic                              |

For the interception side in depth, including passive and active techniques and how to detect them, read our guide to [eavesdropping attacks](https://computese.com/understanding-eavesdropping-attacks-how-they-work/).

## Signs someone may be snooping

- Sign-in alerts or sessions from places or devices you do not recognize.
- Email forwarding rules, filters or delegates you did not set up.
- Unknown devices in the "linked devices" list of WhatsApp, Signal or similar apps.
- Third-party apps with permission to read your mail, files or contacts.
- Certificate warnings on websites you use every day.
- On phones: unexplained battery drain, data use or a device that stays warm when idle, which can point to stalkerware.
- On networks: interfaces in promiscuous mode, new port mirroring sessions, or a DHCP server that should not exist.

## How to prevent snooping

### For organizations

1. **Encrypt data in transit and at rest.** TLS everywhere (with HSTS on websites), encrypted DNS where supported, and full-disk encryption such as BitLocker or FileVault on every laptop.
2. **Grant least privilege, and log access.** People should reach only the records their role needs, and access to sensitive data should be logged and reviewed. Reviews are what deter insider snooping.
3. **Use phishing-resistant MFA.** FIDO2 security keys or passkeys stop most of the account takeovers that email snooping starts from.
4. **Block external auto-forwarding** and alert on new inbox rules and newly consented mail apps.
5. **Harden the network.** Enable DHCP snooping, Dynamic ARP Inspection and port security on switches, use 802.1X for wired and wireless access, [WPA3 on Wi-Fi](https://computese.com/how-to-set-up-secure-home-network/), and restrict who can configure mirroring.
6. **Protect endpoints.** Keep devices patched, run endpoint detection and response, lock screens automatically, and check shared machines for unknown USB devices.
7. **Train people for the low-tech cases.** Privacy filters on laptops used in public, screen locking, and a clear way to report something odd.

### For individuals

- Use a password manager and turn on multi-factor authentication, preferably with passkeys or a security key.
- Review linked devices, forwarding rules and connected apps in your main accounts every few months.
- Avoid entering personal information on public Wi-Fi unless the site uses HTTPS, and never click through a certificate warning.
- Keep your phone's operating system updated and install apps only from official stores.
- Lock your devices, and do not leave them unlocked and unattended.

If you want these controls set up and kept up for your team, our [IT support service](https://computese.com/services/it-support/) covers device, account and network hygiene day to day, and our [security scanning](https://computese.com/services/security-testing/) shows what an outsider could see and reach from the internet.

## Key terms
- **Snooping**: Unauthorized access to data belonging to someone else, whether it is moving across a network, stored on a device or shown on a screen.
- **Confidentiality**: The C in the CIA triad (confidentiality, integrity, availability): information is disclosed only to people and systems authorized to see it.
- **Traffic analysis**: Inferring information from communication patterns and metadata, such as sizes, timing and endpoints, without reading the content.
- **DNS cache snooping**: Querying a DNS resolver in a way that reveals whether a domain is already in its cache, which hints at which sites its users visit.
- **DHCP snooping**: A switch feature that allows DHCP server replies only from trusted ports and records which IP address each device received, blocking rogue DHCP servers.
- **Dynamic ARP Inspection (DAI)**: A switch feature that uses the DHCP snooping table to drop forged ARP replies, which stops ARP spoofing on that network.
- **IGMP snooping**: A switch feature that listens to multicast membership messages so multicast traffic goes only to ports that asked for it (RFC 4541).
- **Bus snooping**: A cache coherence technique in multicore processors: each cache watches shared memory traffic so no core works with stale data.
- **Stalkerware**: Monitoring software installed on a phone or computer without the owner's informed consent, used to read messages and track location.

## Common questions

### What is snooping in simple terms?

Snooping is looking at information you are not allowed to see: someone else's network traffic, files, emails, messages or screen. In cyber security it covers everything from reading over a shoulder to capturing packets on a Wi-Fi network.

### What is an example of a snooping attack?

An attacker who briefly gains access to a manager's mailbox adds a hidden rule forwarding every message about payments to an outside address. Nothing breaks, and the attacker reads the finance team's conversations until someone notices the rule.

### Is snooping the same as eavesdropping?

They overlap. Eavesdropping is intercepting communications as they happen. Snooping is broader: it also covers data at rest, such as browsing someone's files, reading records without a business need or looking at an unlocked device.

### What does snooping mean in computer networking?

Two things. It can mean an attack, capturing or inspecting traffic you should not see. It also names switch features, DHCP snooping and IGMP snooping, which inspect control traffic to block rogue DHCP servers and to deliver multicast efficiently.

### How do I know if someone is snooping on my computer or accounts?

Check for sign-in alerts from unknown places, devices you do not recognize in your account or messaging app's linked devices list, email forwarding rules you did not create, unfamiliar apps with access to your mail, and on phones, unexplained battery drain or data use.

### Is it snooping if my employer monitors my work computer?

Monitoring that the organization is authorized to do, and has disclosed in its policies, is monitoring rather than snooping. The line is authorization and purpose, and the rules differ by country and province, so employers should have legal advice on their monitoring policy.

## Sources
1. [X.800: Security architecture for Open Systems Interconnection for CCITT applications](https://www.itu.int/rec/T-REC-X.800-199103-I/en), ITU-T
2. [Glossary: passive attack](https://csrc.nist.gov/glossary/term/passive_attack), NIST Computer Security Resource Center
3. [Glossary: sniffer](https://csrc.nist.gov/glossary/term/sniffer), NIST Computer Security Resource Center
4. [Network Sniffing, Technique T1040](https://attack.mitre.org/techniques/T1040/), MITRE ATT&CK
5. [Email Collection: Email Forwarding Rule, T1114.003](https://attack.mitre.org/techniques/T1114/003/), MITRE ATT&CK
6. [Input Capture: Keylogging, T1056.001](https://attack.mitre.org/techniques/T1056/001/), MITRE ATT&CK
7. [RFC 4541: Considerations for IGMP and MLD Snooping Switches](https://www.rfc-editor.org/rfc/rfc4541.html), IETF
8. [RFC 8484: DNS Queries over HTTPS (DoH)](https://www.rfc-editor.org/rfc/rfc8484.html), IETF
9. [RFC 7858: Specification for DNS over Transport Layer Security (TLS)](https://www.rfc-editor.org/rfc/rfc7858.html), IETF
10. [Mobile Communications Best Practice Guidance](https://www.cisa.gov/resources-tools/resources/mobile-communications-best-practice-guidance), CISA
11. [Securing Wireless Networks](https://www.cisa.gov/news-events/news/securing-wireless-networks), CISA
12. [Are Public Wi-Fi Networks Safe? What You Need To Know](https://consumer.ftc.gov/articles/are-public-wi-fi-networks-safe-what-you-need-know), U.S. Federal Trade Commission