How does sniffing/wiretap work?
Ethernet was built around a “shared” principle: all machines on a local network share the same wire. This implies that all machines are able to “see” all the traffic on the same wire. Thus, Ethernet hardware is built with a “filter” that ignores all traffic that doesn’t belong to it. It does this by ignoring all frames whose MAC address doesn’t match. A wiretap program turns off this filter, puttin the Ethernet hardware into “promiscuous mode”. Thus, Mark can see all the traffic between Alice and Bob, as long as they are on the same Ethernet wire.
