- Example Packet Sniffers
- WinPcap / Pcap
- Using Ethereal eg
- Re-assembling TCP Session Packets
- Sniffer Detection
- Passive Sniffing Methods
- Active Sniffing Methods
- Flooding the Switch Forwarding Table
- ARP Cache Poisoning in Detail
- APR Countermeasures
- Using ARP Poisoning Tools
- Dsniff Suite
- What is DNS Spoofing?
- DNS Spoofing Tools
- Intercepting and Cracking SSL
- Fake Certificate Injection
- VoIP Systems
- Reconstructing VoIP Streams
- Remote Desktop Protocol
- Sniffing RDP
- Routing Manipulation Methods to Help Sniff (Layer 3)
- Countermeasures for Sniffing
- Session Hijacking
- TCP Session Packet Analysis
- Session Hijacking Tools
- Session Hijacking Countermeasures
- Laboratory Scenario

Source:
http://www.mile2.com/Certified_Penetration_Testing_Specialist_CPTS.html

Don