Hi all, I was sniffing traffic on my work network (and yes I do have permission) and I was collecting hashes to see if I can crack them so that I can make a recommendation to use stronger, longer passwords. But one thing I noticed is that every time is collected a hash it was different even if it was for the same user? Why is this?

What application/service were the hashes related to? Are these Windows logons, or something else? Some services will use a nonce value combined with the password to produce a unique hash value each time. Or, it could be something completely different; you really need to take a look at how the service in question works, what kind of hashing it uses, and how that hashing is implemented.