I would like to know if it is possible to remote monitor the incoming and outcoming network traffic of a specific IP from my network. I need to log the time, ip numbers and port that contact the computer as well the answers.

I cannot change any configuration/install of the machine. (so cannot install wireshark or a lower level app like tcpdump)

best regards,

4 Answers 4


I'm assuming that what you're doing is related to ethical pen. testing. If you have no legitimate control over your target, you have 3 options

  1. Haxoring your target: Attempt to gain access to the target machine by exploiting some vulnerabilities in the machine itself, or the operator of the machine.

  2. Big Man in the Middle (Between your target and the servers to which he's connecting): Attempt to gain access to the network device used by your target. For example, find some vulnerabilities or default passwords in the routers or gateways your target uses.

  3. Man in the Middle (Between your target and his local network gateway): Attempt to trick your target into sending his traffic through you. By far, the easiest way to achieve this is through ARP Spoofing. An easy-to-use tool is Cain and Abel.

Cain and Abel
(Cain and Abel)


You have three options:

  • install wireshark or similar on the target
  • monitor traffic through the network device
  • add your own network device that is in a position to detect the target traffic

From your own comments, options 1 and 2 are ruled out already. It may be, though, that you are precluded from the final option by your contract.

In my opinion you would be best served by requesting a monitoring tool from the company that provides the network or owns the contract. If this meets the needs of the company then you may get it agreed.

  • I will try request a monitoring tool like tcpdump or wireshark.
    – Winter
    May 2, 2013 at 13:26

This is easy to do provided you have administrative access to your network devices, and they support port mirroring . What you do is mirror the port of the end point you want to monitor, and then use a sniffing tool like wireshark, tcpdump, or snoop to record the traffic.

  • I cannot configure port mirroring since i am a third party on company. I will execute some vulnerabilities tests and as usual if anything happens in the network the fault will be mine since i am the evil guy... That is why i want to monitor everything from the target machine.
    – Winter
    May 2, 2013 at 10:12
  • If you have administrative access to the machine you could simply run wireshark or tcpdump on it and capture the data. If you're doing a vulnerability scan from it that would be a big capture though, you'd want to think about performance.
    – GdD
    May 2, 2013 at 10:34

You just need to set up some monitoring software eg Anturis (http://www.anturis.com) and use it. It will not only monitor the traffic, but some troubles or malware.

  • While you do include a reference to software you don't give any information related to how to actually accomplish the task at hand. Your answer would be much better received with such information.
    – Scott Pack
    Jun 26, 2013 at 12:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .