Local wired shared-medium networks can roughly be divided into two groups, and the analyzers’ work specificity varies according to the networks' structure. Therefore, unlike a usual spying program that only captures traffic related to the particular endpoint, a sniffer can log traffic from the whole network (or an available part of it,) thus being a much more encompassing tool. However, within one network, much more data flows “past” each client. Usually, a client receives and views only data intended for its IP address. To explain what a packet analyzer (another name for a sniffer) does, besides likening it to a road checkpoint, where all passing vehicles are inspected, we’ll have to explain how endpoints receive data in normal conditions without a sniffer involved. Software sniffers can be installed on servers, intermediate devices, and endpoint computers.

Hardware sniffers can be (and sometimes are) embedded in routers, modems, and other types of nodes. However, they are also a potential instrument of data and information thieves. Not necessarily a malicious tool, sniffers can be of service to network administrators, Internet service providers, and security specialists. They do not intrude into the data transfer, just copy the Internet packages they can reach. Sniffers are the application software, firmware, or hardware module that aims to gather the data sent from- and to the system of the entire network. Then, the one who sets this surveillance receives this data - and figures out what to do next. ApSniffers are like a hidden camera that sits in the dark corner and gets everything that happens in the room.

Ip sniffer