Packet sniffing
Capturing and reading network traffic passing an interface. The fundamental tool for all network troubleshooting — and the same technique an attacker uses to steal data.
The network card is put in promiscuous mode so it keeps frames addressed to others too. Back when networks were built with hubs you therefore saw everything; on a switched network you see only your own traffic plus broadcast, and reaching the rest requires a SPAN port, a physical TAP or an attack such as ARP spoofing. The tools are libpcap, tcpdump on the command line and Wireshark when you want protocols decoded. Encryption helps a great deal but not completely — SNI, certificates, packet sizes and timing patterns still leak information about who is talking to whom.