Skip to content
Cleartext traffic

An open network.
Readable credentials.

Three interactive Wireshark demonstrations: Telnet, FTP and HTTP expose your credentials in cleartext on the network. Then the same request over encrypted HTTPS.

Realistic WiresharkTelnet / FTP / HTTPTLS comparisonMITM topology
Network topology

💻 Victim

192.168.1.12

📡 WiFi

Shared network

👤 Attacker

192.168.1.47

traffic
listening
$ip link set eth0 promisc on
$wireshark -i eth0 -f "port 23"
Active listening — waiting for Telnet traffic…
⚠ On this network, every packet is visible to all participants
Step 1 of 4

Victim and attacker on the same network

Corporate Wi-Fi, a hotel, or a café: all unencrypted traffic is visible to everyone.

The local network is an illusory zone of trust

On a shared network, any device can listen to other people's traffic. The attacker needs no special access — they're simply connected to the same Wi-Fi. In promiscuous mode, their network card captures every frame.

Key figures

Port 0

Telnet — credentials in cleartext

visible in every TCP frame, no effort needed

0 ms

Detection time

with Wireshark on an unencrypted network

TLS 0,0

Today's standard

renders credentials unreadable on the network

Technical demo

Watch the capture live

Simulate a Telnet, FTP, or HTTP session and watch your credentials appear in Wireshark just as an attacker on the same network would.

Interactive demonstration

Cleartext traffic capture

Simulate a Wireshark capture across three unencrypted protocols and watch credentials appear in real time.

bash — Telnet session

Telnet connection settings

Attack topology (MITM)

Client

10.0.0.2

Attacker

MITM / Sniff

Server

10.0.0.1

Wireshark — eth0 — live capture
Capturing
No.TimeSourceDestinationProtoLenInfo
Waiting for traffic…

Protocol comparison

What the attacker sees

Same Wireshark, same network — opposite result depending on the protocol used.

Telnet — port 23Unencrypted
Cleartext traffic — captured by the attacker
TCPSYN → 10.0.0.1:23
TelnetServer: Username prompt
TelnetUSER admin⚠ EXPOSED
TelnetPASS secret123⚠ EXPOSED
TelnetAUTH SUCCESS → Router>
SSH — port 22Encrypted
Encrypted traffic — unreadable
TCPSYN → 10.0.0.1:22
SSHSSH-2.0-OpenSSH_9.3
SSHKey Exchange: curve25519
SSH[Encrypted — opaque]🔒
SSH[Encrypted — opaque]🔒

Encrypted protocols render traffic opaque even with full network access — the attacker only sees unreadable bytes without the session key.