blocks|key|432152|text|这有点像问汽车和方向盘的区别。当你开车的时候，你可以(而且很可能应该！)引导它。但你也可以开自行车..。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|432153|类比够了，在我看来，不同之处在于，MitM是一类攻击，而嗅探只是用来分析网络上的数据包(通常只是从网卡发送到/来自网卡的数据包)。|432154|一旦有人成为中间人攻击中的“人”，他们就能嗅到目标的进出数据包。|432155|其他相关的攻击/术语(举几个例子)是Arp中毒和DNS劫持|offset|length|entityMap|0|LINK|mutability|MUTABLE|url|http://en.wikipedia.org/wiki/ARP_poisoning|1|http://en.wikipedia.org/wiki/DNS_hijacking^0|0|0|0|I|5|0|O|5|1^^$0|@$1|2|3|4|5|6|7|S|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|T|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|U|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|V|8|@]|9|@$H|W|I|X|1|Y]|$H|Z|I|10|1|11]]|A|$]]]|J|$K|$5|L|M|N|A|$O|P]]|Q|$5|L|M|N|A|$O|R]]]]

It's sort of like asking the difference between a car and steering. When you are driving a car, you can (and probably should!) steer it. But you can steer a bike too...

Enough with the analogy, the difference, in my view, is that MitM is a class of attack and the sniffing is simply the word for analyzing packets on the network (and often just the packets going to/from your network card). 

Once someone has become the "man" in a man-in-the-middle attack, they are able to sniff incoming/outgoing packets of their target. 

Other related attacks/terms (to name a few) would be <a href="http://en.wikipedia.org/wiki/ARP_poisoning" rel="nofollow">Arp Poisoning</a> and <a href="http://en.wikipedia.org/wiki/DNS_hijacking" rel="nofollow">DNS hijacking</a>

blocks|key|432001|text|通常，窃听者(嗅探器)将是被动的--也就是说，他们不会修改通信量。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|432002|中间人(MiTM)攻击通常意味着一个活跃的对手--在传递消息之前更改消息内容的人。|432003|这两者并不完全不同，因为MiTM可能使用它们的主动攻击来读取消息的内容，或者只是中断通信。|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|G|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|H|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|I|8|@]|9|@]|A|$]]]|F|$]]

Typically, an eavesdropper (sniffer) will be passive -- that is they will not modify the traffic.

Man-in-the-middle (MiTM) attacks usually imply an active adversary -- one who will change the contents of the message before passing it on. 

The two are not entirely distinct, as a MiTM may use their active attack to read the contents of messages, or simply to disrupt communications.

blocks|key|432089|text|嗅探攻击就是对机密性的攻击。它可以通过交换机上的span端口，流量通过的服务器上的进程，在最终用户客户端上进行。嗅探通常是一种MITM攻击，但它是被动的。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|432090|MITM攻击通常是一种更主动的攻击，其中流量路由已被更改为包括对手，如流氓访问点或ARP/DNS中毒，以允许嗅探攻击、破坏加密和/或篡改内容传递(完整性和机密性攻击)。|432091|一旦确定为主动攻击，MITM就可以劫持会话，更改内容以隐藏活动，注入恶意代码，并根据访问的服务执行敏感功能。一些，但不是所有的这一切是可能的后续从被动嗅探攻击使用收集的信息。|432092|相关/类似的攻击有MiTB+(浏览器中的man)、密钥记录、会话劫持、单击劫持和XSF。|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|J|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|K|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|L|8|@]|9|@]|A|$]]]|H|$]]

A sniffing attack is a attack on confidentiality. It can be via a span port on a switch, processes on servers through which the traffic passes, on the end user client. Sniffing is often an MITM attack but it is passive.

A MITM attack is typically a more active attack where the traffic route has been altered to include the adversary, such as a rogue access point, or ARP/DNS poisoning, to allow a sniffing attack, break encryption, and/or tamper with the delivery of content (an integrity and confidentiality attack).

Once established as an active attack a MITM can hijack sessions, alter content to hide activity, inject malicious code, and depending on the service accessed perform sensitive functions. Some but not all of this is possible as a follow on from a passive sniffing attack using the information gathered. 

Related / similar attacks are MiTB (man in the browser), keylogging, session hijacking, click jacking, and XSF.

blocks|key|4533257|text|问题应该是“ARP中毒和网络嗅探的区别”|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4533258|MITM攻击在这两种情况下都可能发生。网络嗅探在每个内部网络中都是可能的，除了加密或端点安全之外，没有其他治疗方法。如果您使用的是公共wifi或不受信任的网络，则不应该通过网络或互联网使用未加密的服务。例如，如果您正在浏览并登录非https网站，攻击者可以劫持您的会话。|4533259|在ARP中毒过程中，攻击者甚至可以改变通信量，因为攻击者的机器成为目标机器的网关。一个例子就是通过ARP中毒来欺骗DNS。由于攻击者的机器是目标的网关，所以他可以伪造DNS并将facebook.com解析到自己的IP。然后，他可以在他的IP上托管一个网络钓鱼页面。这就是为什么每当你访问facebook.com或其他人时，你应该检查上面的绿锁。如果您在https://www.facebook.com上看到一些SSL错误，那么可能意味着有人在您和facebook.com中间，您不应该强迫浏览器继续操作。ARP中毒是可以预防的，而且在大型组织中基本上是不可能的。|offset|length|entityMap|0|LINK|mutability|MUTABLE|url|https://www.facebook.com/^0|0|0|4W|O|0^^$0|@$1|2|3|4|5|6|7|O|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|P|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|Q|8|@]|9|@$F|R|G|S|1|T]]|A|$]]]|H|$I|$5|J|K|L|A|$M|N]]]]

The question should actually be "Difference between ARP Poisoning and Network Sniffing"

MITM attack can occur in both cases. Network sniffing is possible in each and every internal network and there is no other cure other than encryption or end point security. If you are on public wifi or untrusted network, you shouldn't be using unencrypted services over network or internet. For example an attacker can hijack your session within a network if you are surfing and logged into a non-https website.

While in ARP poisoning, attacker can even alter traffic because attacker's machine becomes the gateway of target machine. An example would be DNS spoofing via ARP poisoning. Since attacker's machine is the gateway of target, he can fake the DNS and resolve facebook.com to his own IP. He can then host a phishing page on his IP. So thats why whenever you visit facebook.com or others, you should check the greenlock on top. If you see some SSL error on <a href="https://www.facebook.com" rel="nofollow noreferrer">https://www.facebook.com</a> then it probably means someone is in the middle of you and facebook.com and you shouldn't force browser to proceed. ARP poisoning can be prevented and is mostly not possible in big organizations.

blocks|key|4533300|text|攻击可以同时分为多个分类。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4533301|在这种情况下，这些攻击都处理两个主机之间捕获的网络通信。决定因素是如何处理捕获的数据。|4533302|Man+in+the+(MITM)|header-two|4533303|在这里，网络流量被秘密捕获并在两个主机之间中继。如果数据未被转发到预期的收件人，则攻击不是MITM攻击，而是拒绝服务(DoS)攻击。事实上，即使数据被转发，但在次优速度下，攻击同时也是MITM和DoS攻击。|4533304|嗅探|4533305|这是对捕获的网络流量的分析。如果有人只是分析他的机器(比如Wireshark)捕捉到的流量，那只是被动的嗅探。如果有人用ARP中毒来捕获流量，然后分析该流量，那么这将成为一种主动嗅探攻击。|4533306|--关于ARP中毒|4533307|的一个词|4533308|严格地说，这只是允许不同类型的后续攻击的初步步骤.同样，这取决于对捕获的网络流量做了什么。如果通信量未被转发到其预定目标，则会受到DoS攻击。如果是的话，你会受到MITM的攻击。如果还分析了流量，那么您还会受到嗅探攻击。|entityMap^0|0|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|T|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|U|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|V|8|@]|9|@]|A|$]]|$1|G|3|H|5|6|7|W|8|@]|9|@]|A|$]]|$1|I|3|J|5|F|7|X|8|@]|9|@]|A|$]]|$1|K|3|L|5|6|7|Y|8|@]|9|@]|A|$]]|$1|M|3|N|5|F|7|Z|8|@]|9|@]|A|$]]|$1|O|3|P|5|6|7|10|8|@]|9|@]|A|$]]|$1|Q|3|R|5|6|7|11|8|@]|9|@]|A|$]]]|S|$]]

An attack can fit into multiple classifications at the same time.
In this case, these attacks both deal with captured network traffic between two hosts. The deciding factor is what's done with the captured data.
Man in the Middle (MITM)
Here network traffic is secretly captured and relayed between two hosts. If the data is not relayed to its intended recipient, then the attack is not a MITM attack, but rather a denial of service (DoS) attack. In fact, even if the data is relayed, but at suboptimal speeds, then the attack is both an MITM and a DoS attack.
Sniffing
This is the analysis of captured network traffic. If someone just analyzes captured traffic intended for his machine (with say Wireshark), that's just passive sniffing. If someone captures traffic with say, ARP poisoning, and then analyzes that traffic, then that becomes an active sniffing attack.
A word about ARP Poisoning
Strictly speaking, this just a preliminary step that allows for different types of follow-up attacks. Again, it depends what's done with the captured network traffic. If the traffic is not relayed to its intended target, you have a DoS attack. If it is, you have an MITM attack. If the traffic is also analyzed, then you additionally have a sniffing attack.

What's the difference between MITM attack and sniffing? Also could anyone name a few other attacks similar to those?

What's the difference between mitm attack and sniffing?

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

教程

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云智能顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

EdgeOne AI 安全实战专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

聚焦“写作效率、视觉美观与运行性能”三方面进行全面升级，为您提供更高效、稳定的创作环境

社区富文本&Markdown编辑器全新改版上线，欢迎大家体验!

诚挚邀请您参与本次调研，分享您的真实使用感受与建议。您的反馈至关重要，感谢您的支持与参与！

社区新版编辑器体验调研

MITM攻击和嗅探有什么区别？还有人能说出其他类似的攻击吗？

问mitm攻击和嗅探有什么区别？
EN

回答 5

Security用户

Security用户

Security用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问mitm攻击和嗅探有什么区别？EN

回答 5

Security用户

Security用户

Security用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问mitm攻击和嗅探有什么区别？
EN