(A collection of sniffer analysis cases. There are many cases and the documents are a little old. However, the protocol specifications under the IPv4 version have not changed for so many years, and they can still be used for reference
This document contains the following attachments:
Sniffer case collection doc
Sniffer case analysis - ARP spoofing rar\....)