Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

How can I listen to a remote IP's traffic using Wireshark? (Man in the Middle)

share|improve this question

4 Answers 4

up vote 2 down vote accepted

If you are using a span port on a switch or something similar (hub, wifi), then you can see all traffic. In wireshark you can then set a display filter like:

ip.src == 10.43.54.65 or ip.dst == 10.43.54.65
share|improve this answer
    
For example ; my wan ip=11.22.33.44 ; and i want a remote "33.44.xx.xx" ip 80,443 port data traffic... How can i make it ? –  acbd aabcde Jul 15 '13 at 19:08
1  
You can't, unless you can reroute the traffic. So unless you are a TIER 1 ISP, you can't :). –  Lucas Kauffman Jul 15 '13 at 19:25
    
@acbdaabcde Wireshark will work when you have access to the local network, or access to the switch to redirect traffic to the Wireshark packet collector. You can't just pick out a computer's traffic from the Internet. –  schroeder Jul 15 '13 at 23:43

If by remote you mean "on my local LAN but not me" then the answer is possibly; If by remote you mean "on a remote LAN" then the answer is "No, not with Wireshark." You'd be looking for something like a network probe with RMON capabilities.

You could use a Span or Mirrored port as Lucas points out or you could force the switch to begin forwarding packets to you in a variety of ways.

Before I continue with more of an answer for possibility #1 let me clearly state that what I am suggesting should be done only with permission and initially in a test environment. Failure to do so could be illegal, possibly get you fired and maybe even bring systems down.

One method is to begin to send unsolicited arps advertising that the machine whose traffic you wish to sniff is actually located at your MAC address. Before launching a test of this type, though, you would need to verify that you have enabled forwarding on your system and then actively forward those packets to the original MAC address. This can be achieved by creating a static ARP entry in your local ARP table for the host that you are sniffing. If you fail to do this then your system will "eat" the packets and the host you are sniffing will be unable to receive packets.

A second method is to simply generate very large numbers of unsolicited ARP responses, seeking to override the CAM table in the switch. These typically max out at about 4096 addresses. Depending on the device the switch will now begin to broadcast all traffic to all ports.

A tool such as Yersinia or Ettercap can be used to effect both of these strategies.

share|improve this answer
    
Thank you very much ; i try... –  acbd aabcde Jul 16 '13 at 2:20
    
Do you know usable Windows based RMON sniffers ? Names ? –  acbd aabcde Jul 16 '13 at 3:36
1  
That's not quite what RMON is. RMON is a protocol/feature that you would find on a switch, router, network probe or other device to which you can connect using a network management tool like OpenView. –  David Hoelzer Jul 16 '13 at 10:11

The previous two answers are absolutely correct: no. I would simply like to add that the REASON they are correct is this: The way Wireshark works (and it is not MITM, by the way) is it simply "listens" for any packets that have been "sent" to your router, and then "receives" them. It never interferes with the router or with the sender. You need to at least be close enough to the router to "receive" the packets being sent to it. Most routers also automatically encrypt their traffic on any machine connected to them, so you will more than likely need to be hooked up to your target network. Hate to disappoint.

share|improve this answer

If you have access to the remote machine you can achieve this by installing packet capture software (e.g. tcpdump) on the remote machine and piping the output of the software back to you through an established channel (e.g. SSH) into your local instance of Wireshark. Needless to say, you should filter out the pipe traffic on the packet capturing software to avoid bogging down the remote system.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.