Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Let's say sniff program is installed on computer A. And let's say I am looking at a Youtube video on the computer B.

Can the sniff program see what computer B is doing?

If that's possible, witch sniffing program can do that? I use Ubuntu if that helps.

share|improve this question

4 Answers 4

Yes, it is possible. There are several ways:

  1. Connect your two PCs using a hub. All traffic will be sent to all ports.
  2. Use a man-in-the-middle attack program like ethercap.
  3. Use port-mirroring feature in a managed switch to forward all traffic from another port.

You can use tcpdump or wireshark for packet capturing.

I am assuming both hosts are located in the same LAN.

share|improve this answer
    
I tried wireshark but I dont get how works. I only can sniff my own computer. Idk how to sniff the other computer. –  TheDegree0 Dec 3 '11 at 15:10
    
you need to be receiving traffic meant for other hosts, due to one of the conditions khaled outlined. –  Sirex Dec 3 '11 at 15:34
1  
ARP poisoning is a mechanism for man-in-the-middle attack as mentioned above. A note for reference. –  Bart Silverstrim Dec 3 '11 at 22:02

Check out Wireshark.

share|improve this answer

This can't be done on a switched network, because (by definition of Ethernet switching) on these networks each switch port only receives frames addressed to devices connected to that port; so your computer will not get a copy of the frames addressed to other devices, and any network sniffer running on it will not be able to examine those frames.

You can work around this limitation if you have some kind of control on the networking equipment and/or layout:

  • You can place a hub between the network switch and the device whose traffic you want to capture, and connect your PC to that hub; hubs forward all traffic to all ports, so your computer will get a copy of all traffic flowing through the hub.
  • You can configure the network switch (if it supports this feature) to forward a copy of some or all traffic to a specific "monitor" port, and then you can connect your computer to that port; with this setup, your computer will receive a copy of the traffic you want to monitor.

About the sniffing program itself, the best one around is WireShark. It's available for both Linux and Windows.

share|improve this answer
1  
Don't forget ARP poisoning! –  Shane Madden Dec 3 '11 at 19:11

I should point out - the Wireshark solution allows you to see what packets are being sent/received. It won't let you, say, watch the same YouTube video, unless you're much more sophisticated than you're likely to want to be.

The way your question is worded it sounds like you might be more interested in whether spyware/employee monitoring can be done remotely without an agent on your machine. And that's possible, but requires a level of technical sophistication your employer isn't likely to have/want/do.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.