I need to capture/analyse the packets of another system connected to same network, is it possible with Wireshark? I have Wireshark installed on my system; what options do I need to capture packets of the other machine ?
You need network access to the other machine ...
This can be accomplished in a few ways (port mirroring on the switch, flooding the switch's MAC table so it becomes a hub, ARP spoofing the target, etc.), but the real answer is that you either need to install Wireshark (or tshark) on the target machine, or get a machine with Wireshark closer to your target's traffic.
After launching Wireshark just go to interface options on the top taskbar, check the interface you want to use, enable promiscuous mode and press capture. This will capture all traffic coming through.
If you want to filter the data to something like for example targeted IP, or a specific protocol, then please refer to this page.
If you are in the same network then use your NIC in promiscous mode or run wireshark in promiscus mode but in this case you will get all traffic of your network. Since you are specifically want to capture the traffic of only one system so it would better to sit in between that system and the gateway of your network(MITM), then you will be able to sniff the traffic.
First of all, you must have access and authorization to do so. If you do so, you can try this:
Ensure your machine allows
If you issue a
cat /proc/sys/net/ipv4/ip_forwarding, you must receive
1as a response.
Your machine must be set as default gateway to the other machine
This will work only to catch traffic to remote networks, not to the local network.
Run wireshark on local machine
I must ask why not run wireshark direct on the remote machine. It will be easier.
If you can successfully arp-spoof the target machine that is one the same network, you can run wireshark on your computer and should be able to capture the traffic from/to the target machine.
Well, I'm not sure if you're on Windows or Linux, but I'll assume Windows, and a typical wireless network...
Step 1: Run Wireshark, set your capture interface as your network card, and make sure you're in promiscuous mode. Oh, and start the capture...
Step 2: There is no step 2. Unless your network is switched or otherwise complicated (or your target is wired up to the AP), you should see all of the traffic on your network. On the whole, I agree with @ThoriumBR . Just run it on the target machine...