0

How is it possible to sniff the whole traffic within a network range even if it's beyond your subnet scope?

For instance, consider your machine having the IP address of 172.16.96.25, but you need to sniff the whole traffic between 172.16.96.1 - 172.16.111.254.

Machine Info

  • Machine OS : Linux or MacOS
  • Tools : No Difference, I'm open to use anything but preferably WireShark
Improve this question

1 Answer 1

Reset to default
1

Assuming you're on a wired Ethernet network, you'd need to ARP Spoof-attack the layer 2/3 device in your network so your ethernet interface (in which Wireshark will be listening) could get all the traffic from the subnet. The ARP spoof will cause the network devices to believe you're computer's ethernet interface is the switch/router's path to send the frames. If you have direct access to the switch/router then it wouldn't be a problem, but most if the time this is not the case and that's why the ARP spoof is required.

Here's some explanation for it from Wireshark:

https://wiki.wireshark.org/CaptureSetup/Ethernet

Improve this answer
2
  • What if I'm using wireless network? Any idea?
    – Parsa Samet
    Commented Apr 28, 2017 at 6:09
  • In 802.11 networks then use Promiscuous Mode, it should get all the frames and packets passing by: "In promiscuous mode the MAC address filter mentioned above is disabled and all packets of the currently joined 802.11 network (with a specific SSID and channel) are captured, just as in traditional Ethernet. However, on a "protected" network, packets from or to other hosts will not be able to be decrypted by the adapter, and will not be captured, so that promiscuous mode works the same as non-promiscuous mode." wiki.wireshark.org/CaptureSetup/WLAN#MAC_Addresses
    – strkIV
    Commented Apr 28, 2017 at 6:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .