dsniff: A collection of network tools for monitoring and spoofing network traffic

Dsniff is one of those toolkits that’s been around long enough to be almost historical, and yet it’s still installed on every fresh Kali box and still shows up in real authorized penetration tests today. Written by Dug Song in the late 1990s/early 2000s, it was one of the first widely available demonstrations of just how weak unencrypted LAN protocols really were — and honestly, it’s still an excellent teaching tool for exactly that reason. Here’s a full, tested walkthrough of what’s actually in the suite and how each piece works.

What Is Dsniff?

Dsniff is a collection of Unix/Linux network auditing and penetration testing tools focused on monitoring and manipulating network traffic, particularly on switched LANs. It’s not a single program — it’s a suite of small, purpose-built utilities that each demonstrate a specific weakness or capability:

• arpspoof — poisons ARP caches to redirect LAN traffic through your machine
• dsniff (the core tool) — passively sniffs and reconstructs interesting data (credentials, etc.) from captured traffic
• dnsspoof — forges DNS responses on a LAN
• macof — floods a switch’s CAM table with random MACs to force it into hub-like broadcast mode
• tcpkill — kills specified live TCP connections
• tcpnice — slows down specified TCP connections by manipulating TCP window sizes
• filesnarf, mailsnarf, msgsnarf, urlsnarf, webspy — passive protocol-specific data extraction tools (NFS files, email, chat messages, HTTP URLs, and live web page mirroring, respectively)
• sshmitm, webmitm — man-in-the-middle proxies for SSH-1 and HTTP/HTTPS

Why Dsniff Still Matters

Even though many of the protocols dsniff targets (Telnet, FTP, unencrypted HTTP Basic Auth, SSH-1) are far less common in modern networks, the underlying LAN-layer weaknesses it demonstrates — ARP cache poisoning, switch CAM table exhaustion, DNS spoofing on a local segment — are still completely valid attack classes on flat, unsegmented networks today. It’s routinely used in authorized penetration tests to demonstrate exactly why network segmentation, port security, and encrypted-by-default protocols matter to a client.

Installing Dsniff

On Debian/Ubuntu:

sudo apt update
sudo apt install dsniff

Confirmed install, which pulled in arpspoof, dnsspoof, dsniff, filesnarf, macof, mailsnarf, msgsnarf, sshmitm, sshow, tcpkill, tcpnice, urlsnarf, webmitm, and webspy:

Setting up dsniff (2.4b1+debian-32build2) ...

Verified binaries installed at:

/usr/sbin/arpspoof
/usr/sbin/dnsspoof
/usr/sbin/dsniff
/usr/sbin/filesnarf
/usr/sbin/macof
/usr/sbin/mailsnarf
/usr/sbin/msgsnarf
/usr/sbin/sshmitm
/usr/sbin/sshow
/usr/sbin/tcpkill
/usr/sbin/tcpnice
/usr/sbin/urlsnarf
/usr/sbin/webmitm
/usr/sbin/webspy

Other platforms:

# Kali Linux ships it preinstalled
# Fedora/RHEL and Arch typically require building from source or an AUR package
git clone https://github.com/tecknicaltom/dsniff.git

arpspoof — ARP Cache Poisoning

arpspoof sends forged ARP replies to make a target believe your machine’s MAC address is the gateway’s (or vice versa), redirecting their traffic through your host — the classic first step of an on-path (man-in-the-middle) position on a LAN.

Syntax, tested and confirmed:

Version: 2.4
Usage: arpspoof [-i interface] [-c own|host|both] [-t target] [-r] host

Example (lab-only — poisoning a target’s ARP cache to believe you’re the gateway):

sudo arpspoof -i eth0 -t 192.168.1.50 192.168.1.1

This tells 192.168.1.50 that you (the attacker box) are 192.168.1.1 (the gateway). For a full bidirectional MITM, you’d also run it in the opposite direction, spoofing the gateway into thinking you’re the target:

sudo arpspoof -i eth0 -t 192.168.1.1 192.168.1.50

You must also enable IP forwarding on the attacking host, or the target loses connectivity entirely instead of being transparently intercepted:

echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward

macof — CAM Table Flooding

macof floods a switch with frames from randomized source MAC addresses to exhaust its CAM (Content Addressable Memory) table. Once a switch’s table fills up, many switches “fail open” and begin broadcasting all traffic to every port like a hub, which can allow passive sniffing without needing ARP spoofing at all.

Verified syntax:

Version: 2.4
Usage: macof [-s src] [-d dst] [-e tha] [-x sport] [-y dport]
             [-i interface] [-n times]

Example:

sudo macof -i eth0 -n 5000

This is a noisy, easily-detected technique — modern switches with port security and CAM table limiting largely mitigate it, which is itself a useful thing to demonstrate during an authorized assessment.

dnsspoof — DNS Response Forgery

dnsspoof listens for DNS queries on the LAN (usually after you’ve already established a MITM position via arpspoof) and answers them with forged responses based on a hosts file you control.

Verified syntax:

Version: 2.4
Usage: dnsspoof [-i interface] [-f hostsfile] [expression]

Example hosts file (spoofhosts.txt):

192.168.1.100 target-internal-app.example.com

Running it:

sudo dnsspoof -i eth0 -f spoofhosts.txt

The Core dsniff Tool — Passive Credential Sniffing

The dsniff binary itself passively monitors traffic and attempts to parse out anything resembling credentials from a wide range of legacy plaintext protocols (FTP, Telnet, HTTP Basic Auth, POP, IMAP, and more).

Verified syntax:

Version: 2.4
Usage: dsniff [-cdmn] [-i interface | -p pcapfile] [-s snaplen]
              [-f services] [-t trigger[,...]] [-r|-w savefile]

Example, reading from a live interface:

sudo dsniff -i eth0

Or reading from a previously captured pcap (a safe, offline way to demonstrate the tool without live interception):

sudo dsniff -p capture.pcap

urlsnarf — Passive HTTP URL Logging

Reconstructs HTTP requests from captured traffic and prints them in Common Log Format, letting you see every URL a target machine requests over plaintext HTTP.

Verified syntax:

Version: 2.4
Usage: urlsnarf [-n] [-i interface | -p pcapfile] [[-v] pattern [expression]]

Example:

sudo urlsnarf -i eth0

Output format resembles a standard web server access log, one line per HTTP request observed.

filesnarf, mailsnarf, msgsnarf, webspy

These follow the same pattern as urlsnarf but target different plaintext protocols:

# Reassemble files transferred over NFS
sudo filesnarf -i eth0

# Extract email sent over SMTP/POP
sudo mailsnarf -i eth0

# Reconstruct instant-messaging chat sessions (legacy protocols like AIM/ICQ/IRC)
sudo msgsnarf -i eth0

# Mirror the web pages a target visits, live, into your own browser
sudo webspy -i eth0

tcpkill and tcpnice — Active Connection Manipulation

tcpkill forcibly terminates matching live TCP connections by injecting RST packets:

Version: 2.4
Usage: tcpkill [-i interface] [-1..9] expression

Example — kill any connection to port 23 (Telnet) crossing the interface:

sudo tcpkill -i eth0 port 23

tcpnice slows down matching connections by manipulating advertised TCP window size and, on some networks, injecting ICMP source-quench messages — useful for demonstrating QoS-adjacent traffic shaping attacks or throttling a target’s bandwidth as part of an authorized denial-of-service test.

sshmitm and webmitm — Active Man-in-the-Middle Proxies

Verified sshmitm syntax:

Version: 2.4
Usage: sshmitm [-d] [-I] [-p port] host [port]

sshmitm specifically targets legacy SSH-1 (it does not work against modern SSH-2, which is what virtually every server uses today — this makes the tool primarily of historical/educational value now, demonstrating exactly why SSH-1 was deprecated). webmitm similarly intercepts HTTP/HTTPS sessions, relying on the target accepting an invalid/self-signed TLS certificate — something modern browsers make far harder than they did when dsniff was written.

How Dsniff Works Internally

The suite is built on libnet (for crafting and injecting packets) and libpcap/libnids (for capturing and reassembling traffic streams). The general workflow across most of the tools follows the same pattern:

1. Positioning: arpspoof or macof first establishes a vantage point where you can see traffic that wouldn’t normally reach your interface — either by poisoning ARP caches (redirecting traffic through you) or by defeating switch MAC learning (forcing broadcast behavior).
2. Capture: the passive tools (dsniff, urlsnarf, mailsnarf, etc.) use libpcap to capture raw frames and libnids to perform TCP stream reassembly, turning fragmented packets back into coherent application-layer data.
3. Protocol parsing: each snarf tool applies protocol-specific parsing logic (FTP USER/PASS commands, HTTP Basic Auth headers, SMTP envelope data, etc.) to extract human-readable output from the reassembled streams.
4. Active injection (for tcpkill, sshmitm, webmitm): these use libnet to craft and inject spoofed packets (RSTs, forged TLS/SSH handshake responses) directly onto the wire.

Real-World Use Cases (Authorized Lab Environments Only)

1. Demonstrating the risk of flat, unsegmented networks Running arpspoof + dsniff in a client’s lab (with written authorization) to show exactly what an attacker on the same VLAN could passively capture, is one of the most effective ways to justify network segmentation and 802.1X investment to stakeholders.

2. Validating switch port security controls Using macof to confirm whether a switch’s port security / CAM table limiting actually prevents flooding-based sniffing, as part of a broader network hardening assessment.

3. Testing DNS security controls Using dnsspoof in an isolated lab to validate whether DNSSEC, DoH/DoT, or network-level DNS monitoring actually catches spoofed responses.

4. Legacy protocol audits Confirming that no systems on a network are still relying on Telnet, FTP, or SSH-1, which the dsniff toolkit is specifically built to exploit.

5. Security awareness training Live-demonstrating (in a closed lab, never against real user traffic) how trivially plaintext protocols leak credentials, which is often far more persuasive to non-technical stakeholders than a slide deck.

Integration with Other Tools

• Wireshark: often run alongside dsniff tools to visually confirm ARP poisoning and inspect the exact packets being forged.
• Ettercap: offers similar/overlapping MITM capability with a more modern, actively maintained interface; often used as a more full-featured alternative or complement to arpspoof/dnsspoof.
• Responder: complements dsniff in Windows-heavy environments by targeting LLMNR/NBT-NS/mDNS rather than classic ARP/DNS.
• Ettercap/Bettercap: frequently used for the initial ARP-spoofing/positioning step in modern engagements, with dsniff’s individual snarf tools sometimes still used for the passive extraction step.

Troubleshooting and Common Mistakes

• Target loses network connectivity entirely during ARP spoofing — you forgot to enable IP forwarding (net.ipv4.ip_forward=1) on the attacking box, so traffic redirected to you has nowhere to go.
• No traffic showing up in dsniff/urlsnarf — confirm you actually have visibility into the target’s traffic (ARP spoofing succeeded, or you’re on a hub/mirrored port); dsniff can’t see traffic it never receives.
• sshmitm doesn’t work against a target server — expected against any modern SSH-2-only server; sshmitm only supports the long-deprecated SSH-1 protocol.
• macof gets blocked almost immediately — many modern managed switches have port security / DHCP snooping / dynamic ARP inspection enabled specifically to prevent this; that’s the control working as intended.
• Permission errors running any of these tools — nearly the entire suite requires raw socket access; run with sudo.

Best Practices

• Always operate strictly within a written, scoped authorization — ARP spoofing and DNS spoofing actively disrupt normal network operation for everyone on the segment, not just your intended target.
• Restore ARP tables and disable IP forwarding immediately after testing (arpspoof doesn’t clean up after itself automatically; consider running a final un-spoof pass or restarting the affected hosts’ ARP caches).
• Prefer testing in a fully isolated lab VLAN over a live, in-use segment whenever the goal is demonstration rather than validating live production defenses.
• Pair active tools (arpspoof, macof) with passive capture (Wireshark) so you have a clear, reviewable record of what was actually sent and received during the engagement.

FAQ

Is dsniff still effective against modern networks? Partially. The LAN-layer attacks (ARP spoofing, CAM flooding) remain effective against flat, unsegmented networks lacking port security or dynamic ARP inspection. The application-layer interception tools (sshmitm, webmitm) are largely obsolete against modern SSH-2 and TLS with certificate validation.

Is dsniff illegal to use? The tools themselves are legal, widely available open-source software. Using them against a network you don’t own or don’t have explicit written authorization to test is illegal in most jurisdictions (unauthorized interception of communications, unauthorized computer access).

Does dsniff work on switched networks? Yes — this was actually dsniff’s original claim to fame. Unlike a passive sniffer on a hub, dsniff’s suite is specifically designed to defeat switching via ARP spoofing or CAM table flooding, restoring the attacker’s ability to see traffic not natively destined for them.

Can dsniff intercept HTTPS traffic? Only via webmitm, and only if the target’s browser accepts an invalid TLS certificate — which virtually no modern browser will do without a very obvious warning, making this largely ineffective against up-to-date clients.

What replaced dsniff in modern penetration testing? Tools like Bettercap and Ettercap offer overlapping and more actively maintained MITM capability, while Responder covers Windows-specific name resolution attacks that dsniff predates.

Summary

Dsniff is a foundational, still-instructive toolkit for understanding LAN-layer attacks: ARP spoofing, switch CAM exhaustion, DNS forgery, and passive credential harvesting from legacy plaintext protocols. Its application-layer tools have aged out of relevance against modern encrypted-by-default services, but the network-layer techniques it pioneered remain a standard, effective way to demonstrate — in an authorized lab — exactly why flat networks and legacy protocols are still a real risk today.

References

• Original project page (Dug Song): https://www.monkey.org/~dugsong/dsniff/
• Source mirror on GitHub: https://github.com/tecknicaltom/dsniff
• Man pages: man dsniff, man arpspoof, man macof, man dnsspoof, man urlsnarf, man sshmitm