Given the right permissions, anyone can load a program such as Wireshark and start capturing network traffic. Without going into low-level detail about how a frame is formed (a network packet formed created using the OSI model layers), you can easily filter through a network capture file and view what data your computer has been sending and receiving.
You can sniff your own network traffic and see your own data sent and received, or you can sniff traffic on a switch or hub (where data is sent to to be routed to other devices) and reveal what everyone has been looking at.
Without packet data being encrypted you could see all network requests and responses, along with its data; you could see what websites people have been visiting, users personal information (credentials, bank account data).. Anything.. Providing the data is not encrypted of course. Protocols such as telnet and http will transfer data in plaintext, which means you can extract human-readable data out of it.
Below is a table of terms used throughout this document.
We will use Wireshark, a free and open-source packet analyzer tool to review a pcap file (pcaps are the file extension for network files, commonly associated with Wireshark).
To open a pcap file, on Wireshark click File -> open. This will load the network capture, at a first glance you will see the following columns:
When you select a packet, you will see the following:
Each dropdown section here is a layer in the OSI model. For example, we have the whole frame, then Ethernet (Data Link Layer - Layer 2), Internet Protocol Version 4 (Network Layer - Layer 3), Transmission Control Protocol (TCP - Transport Layer - Layer 4)