Have Geek Brain

Can we sniff packets between two machines on the network from a third machine using wireshark or over-the-air

I have a small network that has two electronic devices and one desktop connected with a switch. Through a desktop with Ethereal / wireshark installed on it, can I sniff the packets that are being sent between two electronic devices?

I cannot install ethereal or wireshark on any of the electronic devices, but you need to monitor traffic between the two devices from my desktop, which connects through the same switch.

0


a source to share


7 replies


You will need to use Cain and Abel or some of them. In other words, you need to use ARP poisoning. Don't know if it's illegal. But it should be.



+3


a source


Change the switch to a good old fashioned hub and then just sniff the traffic as usual. Of course, this may not be for you either, but I thought I'd at least point it out.



+8


a source


Yes, if your switch supports the Mirror Option, which allows you to duplicate the entire packet to a specified port on the switch where your computer will snif the packet. Otherwise, I think it's impossible.

+5


a source


If you have a computer with two Ethernet ports, set it up as a bridge, connect two devices, and sniff with wireshark your content.

+2


a source


Usually, in order to sniff packets through the switch, you need to do an ARP poison attack (so the switch replicates all packets to your sniffing interface). There are tools for such an ARP poisoning attack (Cain and Abel is a great example).

0


a source


There are two ways to do this:

  • Connect your sniffer with Wireshark and two devices to a hub (if you can still find one of them ...)
  • Use a switch with port mirroring capabilities. You must configure the switch to mirror packets from specific ports to the mirror port. You connect your Wireshark computer to the mirror port.
0


a source


The hub would be the easiest way. Then enable the SPAN port. However, if you don't have either of them, and if you mentioned that you have a computer with two ports, you can bridge the two. However, it would be much easier if you could configure the IP addresses of two electronic devices to set up your desktop as a router. In particular, if you are using Linux (or can boot a Linux LiveCD using wireshark on it), you can very easily assign device 1 an IP address of 10.0.0.2 using the default gateway 10.0.0.1 (assuming you can configure the devices on use static IPs, if they use DHCP you will need to configure DHCP server in Linux box and go out of scope). Install a second device with an IP address of 10.0.1.2 with a default gateway of 10.0.1.1. Set linux box like so,so that interface 1 (eth0) has IP 10.0.0.1 and interface 2 (eth1) has IP 10.0.1.1. Connect all 4 interfaces to the switch (you can also directly connect devices to each port, but depending on how old the devices are, they may require crossover cables). The last step is to enable routing; on the linux box as root, echo 1> / proc / sys / net / ipv4 / ip_forward and now two devices will need to go through the linux router so you can sniff the traffic.echo 1> / proc / sys / net / ipv4 / ip_forward and now two devices will need to go through the linux router for you to sniff traffic.echo 1> / proc / sys / net / ipv4 / ip_forward and now two devices will need to go through the linux router for you to sniff traffic.

0


a source






More articles:


All Articles