0

How is it possible to sniff the whole traffic within a network range even if it's beyond your subnet scope?

For instance, consider your machine having the IP address of 172.16.96.25, but you need to sniff the whole traffic between 172.16.96.1 - 172.16.111.254.


Machine Info

  • Machine OS : Linux or MacOS
  • Tools : No Difference, I'm open to use anything but preferably WireShark
2

Assuming you're on a wired Ethernet network, you'd need to ARP Spoof-attack the layer 2/3 device in your network so your ethernet interface (in which Wireshark will be listening) could get all the traffic from the subnet. The ARP spoof will cause the network devices to believe you're computer's ethernet interface is the switch/router's path to send the frames. If you have direct access to the switch/router then it wouldn't be a problem, but most if the time this is not the case and that's why the ARP spoof is required.

Here's some explanation for it from Wireshark:

https://wiki.wireshark.org/CaptureSetup/Ethernet

  • What if I'm using wireless network? Any idea? – Parsa Samet Apr 28 '17 at 6:09
  • In 802.11 networks then use Promiscuous Mode, it should get all the frames and packets passing by: "In promiscuous mode the MAC address filter mentioned above is disabled and all packets of the currently joined 802.11 network (with a specific SSID and channel) are captured, just as in traditional Ethernet. However, on a "protected" network, packets from or to other hosts will not be able to be decrypted by the adapter, and will not be captured, so that promiscuous mode works the same as non-promiscuous mode." wiki.wireshark.org/CaptureSetup/WLAN#MAC_Addresses – strkIV Apr 28 '17 at 6:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.