Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I would like to know if it is possible to remote monitor the incoming and outcoming network traffic of a specific IP from my network. I need to log the time, ip numbers and port that contact the computer as well the answers.

I cannot change any configuration/install of the machine. (so cannot install wireshark or a lower level app like tcpdump)

best regards,

share|improve this question

4 Answers 4

up vote 5 down vote accepted

I'm assuming that what you're doing is related to ethical pen. testing. If you have no legitimate control over your target, you have 3 options

  1. Haxoring your target: Attempt to gain access to the target machine by exploiting some vulnerabilities in the machine itself, or the operator of the machine.

  2. Big Man in the Middle (Between your target and the servers to which he's connecting): Attempt to gain access to the network device used by your target. For example, find some vulnerabilities or default passwords in the routers or gateways your target uses.

  3. Man in the Middle (Between your target and his local network gateway): Attempt to trick your target into sending his traffic through you. By far, the easiest way to achieve this is through ARP Spoofing. An easy-to-use tool is Cain and Abel.

Cain and Abel
(Cain and Abel)

share|improve this answer

You have three options:

  • install wireshark or similar on the target
  • monitor traffic through the network device
  • add your own network device that is in a position to detect the target traffic

From your own comments, options 1 and 2 are ruled out already. It may be, though, that you are precluded from the final option by your contract.

In my opinion you would be best served by requesting a monitoring tool from the company that provides the network or owns the contract. If this meets the needs of the company then you may get it agreed.

share|improve this answer
    
I will try request a monitoring tool like tcpdump or wireshark. –  Winter May 2 '13 at 13:26

This is easy to do provided you have administrative access to your network devices, and they support port mirroring . What you do is mirror the port of the end point you want to monitor, and then use a sniffing tool like wireshark, tcpdump, or snoop to record the traffic.

share|improve this answer
    
I cannot configure port mirroring since i am a third party on company. I will execute some vulnerabilities tests and as usual if anything happens in the network the fault will be mine since i am the evil guy... That is why i want to monitor everything from the target machine. –  Winter May 2 '13 at 10:12
    
If you have administrative access to the machine you could simply run wireshark or tcpdump on it and capture the data. If you're doing a vulnerability scan from it that would be a big capture though, you'd want to think about performance. –  GdD May 2 '13 at 10:34

You just need to set up some monitoring software eg Anturis (http://www.anturis.com) and use it. It will not only monitor the traffic, but some troubles or malware.

share|improve this answer
    
While you do include a reference to software you don't give any information related to how to actually accomplish the task at hand. Your answer would be much better received with such information. –  Scott Pack Jun 26 '13 at 12:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.