3

My machine along with several other machines are connected to wireless router. When i open some http page on same machine(M1) where wireshark is installed, it captures the packets such as HTTP GET or POST but when i open same http page from other device(M2) which is connected to same router, i see the entry for it in wireshark installed on previous machine(M1) but does not show GET or POST.
Instead I see many NBNS entry for M2 in wireshark installed on M1. By this way, one machine can't see the sites which are visited from other machine.

There are many youtube videos showing that it is possible to know the sites that are being visited from other machines.
In my case, I see some entries for other machine but not HTTP request which I was actually doing from other machine.
Is this a config problem?

Improve this question
2
  • Is the interface in monitor mode? Is the network open or secured?
    – David Houde
    Mar 10 '14 at 1:36
  • network is secured but I have given wpa-pwd in pref. Interface is in promiscuous mode.
    – Ameya Bapat
    Mar 10 '14 at 9:26
7

Network traffic can be either unicast or broadcast (or multicast, but that's not relevant right now.) NBNS (NetBIOS Name Service) is broadcast, so the switch (your wireless "router" in this case) has a responsibility to deliver it to every host "attached" to it. Most other traffic is unicast, which means the switch should send it directly to the recipient.

Different kinds of layer-2 network devices do this in different ways:

  • Hubs simply broadcast everything to all their ports, regardless of destination.
  • Switches keep a table (the CAM table) of which MAC addresses are using which ports, and send unicast traffic to the appropriate port.
  • Wireless switches without encryption act like a hub, since radio is omnidirectional.
  • Wireless switches with encryption (oversimplification, assuming WPA) use individual keys to protect unicast data intended for a single recipient, but shared broadcast keys to send broadcast data.

In order to see the traffic destined for some other machine on your network, you need to do some traffic manipulation. Your options generally are:

  • Use a hub instead of a switch. Not possible in the wireless case.
  • Sniff directly from the switch (sniffer software installed on the switch.)
  • Configure a span port on the switch to receive all traffic regardless of destination.
  • Use ARP poisoning, ICMP redirection, CAM flooding, or other traffic manipulation to trick the switch into broadcasting unicast traffic.
Improve this answer
2
  • 1
    Nice answer. One thing I'd add/change to the list of four options, given that, presumably, the OP is on a home router/switch/AP box that doesn't support the two middle options (and the fourth requires some experience), is possibly getting a cheap 4-port hub (not a switch!) and installing that between the existing wifi router/ap and the upstream network (e.g. DSL or cable modem). Plugging the sniffing computer into another port on said hub will do the trick.
    – JJC
    Mar 11 '14 at 14:26
  • 1
    @JJC Yes, though the upstream hub idea won't catch traffic that is local to the switch, and it's most likely doing NAT, which makes identifying individual endpoints difficult.
    – bonsaiviking
    Mar 12 '14 at 0:53
0

It depends on where you installed the sniffing.

If all these devices are directly connect to the wireless router, the sniffing needs to be done in the router. Routers with default firmware does not come with such functions.

You need to install a custom firmware like DD-WRT or tomato

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.