1

I have a small intranet, in which I have complete control over its deployment. I can even do MiTM, packet inspection/injection etc. There is a router and then there are 5 users behind the routers. The issue I am facing is that I cannot identify the traffic originator based on the IP address. If I am analysing the traffic after router, I will always get the public IP, hence I cannot correlate and see if Person A is using google.com, or who accessed X.com.

My question is how to resolve the problem through packet injection? Is there any snippet (javascript that I can insert) in my traffic (HTTP only) to identify and correlate the traffic? Just like Google Analytics.

Improve this question
5
  • 1
    I think you are missing a ton of context here. Are we to assume "you" is a website that these users are connecting to? How is packet injection even possible? If you have complete control over the deployment, do you have control over the router? Or are we to assume that you are simulating an attacker? What access do you have over the traffic?
    – schroeder ♦
    Commented Sep 30 at 8:16
  • @schroeder I dont have control over router. I can see the traffic out from the router though. I can packet injection
    – Johnny
    Commented Sep 30 at 8:17
  • Right. How? We need details here.
    – schroeder ♦
    Commented Sep 30 at 8:20
  • @schroeder well consider as a person in ISP who can see traffic originating our of router
    – Johnny
    Commented Sep 30 at 8:51
  • That doesn't explain as much as you think it might and you have not answered any of the rest of my questions.
    – schroeder ♦
    Commented Sep 30 at 11:05

0

Reset to default

Browse other questions tagged .