sniffer implementation, first step