How is sniffing broadly categorized?

Passive sniffing involves silently monitoring traffic without injecting any packets, typically effective on hub-based networks where all traffic is broadcast. Active sniffing requires the attacker to interact with the network - for example, via ARP poisoning or MAC flooding - to redirect traffic on switched networks. This passive-vs-active distinction is the standard top-level classification for sniffing attacks in security curricula.

Broadcast and unicast describe packet addressing modes at the network layer, not categories of sniffing methodology.

Managed and unmanaged refer to switch hardware types that support or lack administrative control features, not sniffing classifications.

Filtered and unfiltered describe packet capture modes within tools like Wireshark, not the primary taxonomy used to categorize sniffing attacks.