Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I can sniff the traffic of my local pc but I would like to know how to I sniff the traffic of a remote machine by wireshark?

When in capture option I select remote interface and enter my remote ip show me error.code(10061). What should I do?

share|improve this question
4  
You can only sniff traffic that your network interface is seeing. If the network is switched packets to the remote machine will not be sent to you. BTW: try to improve your acceptance rate. –  Matteo Feb 22 '12 at 6:23

4 Answers 4

One approach is to use what's called a mirror or span port on your switch. If your switch isn't inteligent enough you can also put a small hub inbetween the switch/host-to-capture connection. You connect a physical link from your listening host to that port/hub and then you can see all the traffic crossing the device. Alternatively, you'll need to install your packet capture software in a more strategic location in your network like a border firewall/router.

share|improve this answer

On Linux and OSX you can achieve this by running tcpdump over ssh and having wireshark listen on the pipe.

  1. Create a named pipe:

    $ mkfifo /tmp/remote

  2. Start wireshark from the command line

    $ wireshark -k -i /tmp/remote

  3. Run tcpdump over ssh on your remote machine and redirect the packets to the named pipe:

    $ ssh root@firewall "tcpdump -s 0 -U -n -w - -i eth0 not port 22" > /tmp/remote

Source: http://blog.nielshorn.net/2010/02/using-wireshark-with-remote-capturing/

share|improve this answer
    
Hehe, nice catch. –  Marki Aug 10 '13 at 10:47

You can only sniff traffic that makes it to you. So Joe A going to Joe B never comes near your PC, so you can't see it.

Only way is for you to get to the traffic or get the traffic to you. To get to the traffic requires a connection to a router or good switch or hub somewhere in the middle of their connection. To get the traffic to you, you'll need to ARP poison some of the switches so they think your them.

share|improve this answer

see info on setting up the remote computer, to allow your local machine to connect and capture

http://wiki.wireshark.org/CaptureSetup/WinPcapRemote

share|improve this answer
    
Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. –  Scott Pack Oct 21 '12 at 2:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.