0

I need to capture/analyse the packets of another system connected to same network, is it possible with Wireshark? I have Wireshark installed on my system; what options do I need to capture packets of the other machine ?

Improve this question

6 Answers 6

Reset to default
1

You need network access to the other machine ...

This can be accomplished in a few ways (port mirroring on the switch, flooding the switch's MAC table so it becomes a hub, ARP spoofing the target, etc.), but the real answer is that you either need to install Wireshark (or tshark) on the target machine, or get a machine with Wireshark closer to your target's traffic.

Improve this answer
1

After launching Wireshark just go to interface options on the top taskbar, check the interface you want to use, enable promiscuous mode and press capture. This will capture all traffic coming through.

If you want to filter the data to something like for example targeted IP, or a specific protocol, then please refer to this page.

Improve this answer
0

If you are in the same network then use your NIC in promiscous mode or run wireshark in promiscus mode but in this case you will get all traffic of your network. Since you are specifically want to capture the traffic of only one system so it would better to sit in between that system and the gateway of your network(MITM), then you will be able to sniff the traffic.

Improve this answer
2
  • 2
    but if they're only connected through a switch and not a hub, they won't see that traffic, as that usually gets filtered out by the switch.
    – Greg
    Commented Oct 14, 2014 at 17:50
  • ... and most current network use switches, so you will be very lucky if you manage to capture the traffic without doing something more active (e.g., ARP spoofing)
    – Ale
    Commented Oct 14, 2014 at 21:18
0

First of all, you must have access and authorization to do so. If you do so, you can try this:

  1. Ensure your machine allows ip_forwarding

    If you issue a cat /proc/sys/net/ipv4/ip_forwarding, you must receive 1 as a response.

  2. Your machine must be set as default gateway to the other machine

    This will work only to catch traffic to remote networks, not to the local network.

  3. Run wireshark on local machine

I must ask why not run wireshark direct on the remote machine. It will be easier.

Improve this answer
0

If you can successfully arp-spoof the target machine that is one the same network, you can run wireshark on your computer and should be able to capture the traffic from/to the target machine.

http://en.wikipedia.org/wiki/ARP_spoofing

Improve this answer
1
  • Beware, some professional network switches might detect your attempt at ARP spoofing and kick you out and/or produce an alert... so if you're not an admin of the concerned network, make sure you won't get in trouble by doing an ARP spoofing...
    – Ale
    Commented Oct 14, 2014 at 21:19
0

Well, I'm not sure if you're on Windows or Linux, but I'll assume Windows, and a typical wireless network...

Step 1: Run Wireshark, set your capture interface as your network card, and make sure you're in promiscuous mode. Oh, and start the capture...

Step 2: There is no step 2. Unless your network is switched or otherwise complicated (or your target is wired up to the AP), you should see all of the traffic on your network. On the whole, I agree with @ThoriumBR . Just run it on the target machine...

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .