Can you sniff the packets or use a network analyzer or MITM or ARP spoofing to somehow be able to see the videos that someone else is watching on a network in real time?

Also: Can you somehow see when they stop and start the video?

  • What tools/programs would I need to be able to sniff and watch video or view browsing activity real time or as close as you can get on an unencrypted network.
    – Bob Ogden
    Dec 22 '15 at 6:42

What you are trying to do is called "carving" a file in the forensic world. I know there are plenty of off the shelf tools that can pull out images and display them in a browser in real time, so it should be possible to do this with video. It may be more complicated to do a video in real time though do to file access restrictions (one process reading while another is writing). I would imagine you could save to a named pipe and read the named pipe into something like VLC. If a video player can handle streaming video from the Internet which is not coming consistently, it should be able to do this from a named pipe as well. I would imagine for some formats it will only work if you catch the beginning of the steam due to how certain information is packaged and presented.

Alternatively, if the target is just downloading from YouTube, etc. You could just look at the traffic and look for request of a .mp4, .flv, etc. and then download from the same server if is public and you don't care about leaving a foot print. This may be easier then doing the carving and reconstruction of the video file.

I would imagine you could find a way to do this with just wireshark filtering and then saving the output to a file/pipe.

I looked up some carving tools, such as NetworkMiner which at least seem to provide the ability to get the file saved if not viewed in real time:

NetworkMiner can extract files and certificates transferred over the network by parsing a PCAP file or by sniffing traffic directly from the network. This functionality can be used to extract and save media files (such as audio or video files) which are streamed across a network from websites such as YouTube. Supported protocols for file extraction are FTP, TFTP, HTTP, SMB and SMTP.

Some other links you can explore on your own for tools and articles:

In terms of if they start or stop, you would expect that packets would continue to come at a constant rate. The video player may stop downloading the video on pause/stop, but more likely it will build up the buffer. Some video players may send some type of data back on pause. Another clue may be if the video player shows ads when paused, then if saw an ad download that may be an indicator of a pause action. Since video may continue to download and the pause may only be something noted client side, you cannot guarantee detection using only passive methods, but it many cases you could make an educated guess based on other activity.


If the connection is unencrypted then you can sniff the video and watch it, real time if you have the tools and have visibility of the connection (typically by being on the target's network, but not necessarily)

You won't necessarily know when they stop and start the video, as most video services buffer the stream (ie they download ahead of where you are watching)


If the connection is unencrypted, but the video file is encrypted or has certain forms of DRM in place, you may be able to intercept the data, but not view the video. This would particularly be the case for streaming services such as Netflix/Amazon Prime Video.

You could grab packets using a tool like Wireshark, but be aware that this will grab all the traffic on a specific port, not just video content.

  • Assume that neither the connection nor the video file is encrypted. From what I've seen of wireshark you would not be able to view the video real time or close to real time. What software would you need to do this.
    – Bob Ogden
    Dec 22 '15 at 15:01
  • @BobOgden you're right, Wireshark will only capture the packets, you wouldn't be able to view the video in real time as you say Dec 22 '15 at 16:24
  • I also don't need to have a reference from a book. I just want to know how I would be able to view the video or browsing activity in as close to real time as possible
    – Bob Ogden
    Dec 22 '15 at 17:41
  • Viewing browsing data in general is a different issue. For unencrypted sites, it's trivial. For encrypted sites, it's generally difficult without traffic interception that requires end user cooperation.
    – Matthew
    Dec 22 '15 at 17:43
  • @Matthew if it's trivial how is it done
    – Bob Ogden
    Dec 23 '15 at 1:14

I recall seeing this EasyCap receiver in the book Unauthorised Access: Physical Penetration Testing For IT Security Teams.

If there are 2.4 GHz cameras within range, this will access their signals and via the device's USB interface, allow you to rebroadcast their video in an app on your computer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.