How is sniffing broadly categorized?

Passive sniffing captures traffic without sending any packets, relying on shared media or port mirroring where all frames are naturally visible to the sniffer. Active sniffing requires injecting packets using techniques such as ARP poisoning, MAC flooding, or DHCP spoofing to redirect traffic on switched networks - this active-versus-passive distinction is the primary taxonomy used in network security to classify sniffing methods.

Broadcast and unicast describe network transmission addressing modes, not methodologies for intercepting or capturing network traffic.

Unmanaged and managed describe switch capability and administration levels, not sniffing techniques or their operational categories.

Filtered and unfiltered describe Berkeley Packet Filter (BPF) settings applied to a running capture session, not a broad classification of sniffing approaches.