eavesdropping
Picture two people talking on a crowded train. Anyone sitting nearby can simply listen — they don't have to interrupt or do anything; they just overhear. Eavesdropping on a network is the same: an attacker quietly reads packets that are flowing past, without modifying them or revealing themselves. Because it's purely passive, it leaves no trace and the victims usually have no idea it's happening.
How it actually works depends on the medium. On Wi-Fi, radio waves spread in all directions, so anyone in range with the right software can capture frames out of the air. On a wired shared segment or a network the attacker controls, a tool like Wireshark puts the network card into promiscuous mode and records every packet it sees, not just those addressed to it. Compromised routers, switches, or an ISP can read whatever crosses them. The captured data — login forms, cookies, emails, queries — is readable in full if it was sent in the clear, with no encryption.
Why it matters: eavesdropping is the threat that confidentiality is designed to stop, and the defense is encryption. If a connection uses TLS (the lock icon, HTTPS), an eavesdropper still captures the packets but sees only scrambled ciphertext — useless without the key. This is why sending passwords over plain HTTP, or trusting open public Wi-Fi for anything sensitive, is dangerous. One honest limit: even with encryption, an eavesdropper can often still see metadata — which servers you contact, when, and how much data flows — because addresses and traffic patterns are not hidden by ordinary encryption.
On open cafe Wi-Fi, an attacker runs a packet sniffer. If you log into a site over plain HTTP, your password scrolls past in readable text in their capture. Over HTTPS, the same capture shows only encrypted bytes — they learn you visited the site, but not what you typed.
Passive listening: plaintext is exposed, ciphertext is not.
Eavesdropping is passive — the attacker only listens. The moment they start altering or injecting traffic it becomes an active attack (tampering, spoofing, or man-in-the-middle). Encryption stops the listening, but rarely hides the metadata.