I am studying the behaviour of existing eavesdropping techniques (part of my research). I have a question through the following scenario:

Suppose Bob lives in New York and wants to listen (i.e. capture) network traffic in a certain network located at Los Angles. Suppose Bob knows that the network address in LA is How does Bob inject himself inside that network to capture the traffic (using Wireshark for instance)? In other words, what is the way that is mostly used to become a passive intruder in another network so you can eavesdrop whatever you want?

I appreciate your collaboration in this question and hope everyone learns from your experiences.


There is no legitimate way for an unauthorized eavesdropper to access those specific packets. So let's break it down:

  1. Make it legitimate. Eve* could ask Alice or Bob for those packets.
  2. Authorize it. Eve could be a law enforcement officer, and request the network provider to deliver copies of those packets.
  3. Be less specific. If Eve is a thief who just wants to steal from anyone, there's no reason she has to hack a network in L.A.; she could hack one closer to home where she has physical access.

If Eve is prepared to engage in criminal activity, she would then have to hack into Alice and Bob's network, and gain access to one of the devices on one of the subnets carrying their traffic. Your specific example of may be a problem for her, as that is a non-routable address range, commonly managed by home routers behind a NATting firewall (in other words, 192.168.. is not a unique address, it's shared by millions of home networks.) But she can find their network through some other means. One way is via an email embedded with an HTML image, which has to "phone home" to retrieve the image when the message is read. That will give her the routable ("outside") address of her firewall.

How she hacks into their network is as broad a question as "how to hack?" and can't really be answered. But let's say she gains access into the network by portscanning their firewall, and finding a hole opened by some irresponsible home automation device that uses UPnP. Let's say she gained access via an insecure thermostat's web interface.

If sniffing network packets is her ultimate goal, she'll need to access a machine capable of running packet capture software. This may require using a machine more capable than the thermostat she hacked into. So she may need to 'pivot' to another machine inside the victim's network to gain access to a PC. Once the thermostat is acting as a relay, she searches the network looking for other machines, and finds an unpatched PC. She takes it over, and from the victim PC, she establishes a 'reverse shell' back to her computer, giving her command access to it. On this remote PC, she'll install a packet capture program like tshark, and run it for a while. This will produce a capture file without the graphical interface. After capturing packets, she'll copy the packet trace file back to her computer and run a tool like Wireshark to view and analyze the contents.

* The set of placeholder names often used in cryptographic protocol analysis includes Alice and Bob, who want to communicate with each other; Eve, a passive attacker who can eavesdrop but cannot tamper with their communications; and Mallory, an active attacker who can both listen to and tamper with their communications. You may find it useful to understand and use these common names.

| improve this answer | |

Here are two ideas which show the dangers of phishing and social engineering, among other things.

  1. If it's a 10BASET or 100BASETX network (unlikely), Bob can fly to LA and try to find their network entry point. If Bob has enough money, this is even easier.
    • Bob shows up pretending to work for the ISP and says he has to fix something. Corporate/business security either doesn't exist, or they have lax rules. You must always verify everyone coming into your building, no matter who they say they are, or for what reason they're claiming to be there.
    • If they're stupid, Bob can then install a passive network tap (only works on 10BASET or 100BASETX), such as a Throwing Star LAN Tap. If Bob has enough money, there are even more nefarious things he can do.
  2. Bob can attempt a phishing campaign against users of the LA Network. Example:
    • Google.com > Company name
    • Locate email addresses
    • Send emails with infected attachments. Hope someone opens.
    • Now you're in, you've got Hapless User. Study their typed word patterns so as not to arouse suspicion. Grab their contacts. Look for important people. Network Administrators, etc.
    • Use Hapless User account to send infected attachment to important people, so it appears genuine.
    • Secretly install some kind of packet capturing malware on the important people's machines, if you can find them.

And this is one of the many reasons why larger companies should invest in both physical and IT Security.

| improve this answer | |
  • Great explanation Mark. – Mido A Jan 19 '16 at 21:08
  • @MidoA I had to edit it. I made a mistake on the 10BASET and 100BASETX. Passive taps work on those, just not the higher ones. I mixed up the two. Sorry! – Mark Buffalo Jan 20 '16 at 0:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.