Why can a packet sniffer in an Ethernet LAN obtain all packets sent over the LAN? Why can a packet sniffer in an Ethernet LAN obtain all packets sent over the LAN? > In a limited broadcast environment, such as in many Ethernet LANs, a packet sniffer can obtain all packets sent over the LAN. We know if there is a Wi-Fi network, we can use a packet sniffer to catch the packets, but how about a wired Ethernet LAN?

In classic (obsolete) Ethernet, a shared wire or repeater hubs were used. So, each node physically receives every frame sent within the broadcast domain (also the collision domain in this case). Frames that are received but that are not addressed to the receiving NIC's MAC address are ignored (dropped). In a network like that, a NIC in promiscuous mode can capture all traffic.

For the last two decades or so, shared-wire or repeated Ethernet is obsolete. On switched Ethernet, each frame is forwarded only in the direction of its destination. To tap into an Ethernet communication requires listening in on the source or destination port directly or via port mirroring (aka port monitoring or SPAN) [edit after comments] and promiscuous mode on the capturing NIC, of course.[/edit]