Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am using wireshark on Windows to capture my traffic.

Is there a way to capture the traffic of other computers which are connected to the same LAN. If it is not possible with wireshark, is there other tool capable of doing this.

share|improve this question
    
This might be better answered on SuperUser or UNIX SE. –  mdpc Oct 25 '12 at 18:17
2  
@mdpc Why do you think so? Capturing traffic from a misbehaving device is something network admins do all the time. –  MDMarra Oct 25 '12 at 18:49
    
@MDMarra funny that both ofyour names begin with MD –  Артём Царионов Feb 19 '13 at 17:59
add comment

3 Answers

up vote 1 down vote accepted

One way to achieve what you want is to use an arp poisoning tool, such as Ettercap. You should be able to Wireshark/tcpdump the information you require.

The problem you have is that an Ethernet switch is designed so that it learns the MAC addresses on each port and uses this to "route" Ethernet frames to the correct port based on their MAC address. This is to reduce collisions associated with Ethernet hubs (something you rarely see these days). Therefore, you will only see Ethernet frames destined to or originating from your NIC including broadcast Ethernet frames, such as ARP, but not foreign traffic. This is a good thing :)

Most managed switches (not a dumb desktop one) allow you to designate a port mirror so that all Ethernet frames are replicated on a specific port where you can attach a machine in promiscuous mode and capture "foreign" Ethernet frames using tcpdump/Wireshark.

This still won't let them be captured by Wireshark/tcpdump, however. So you need a way to act as an Ethernet bridge between the interesting hosts and their gateway but without being physically in the path. Enter Ettercap which is an arp poisoning tool. It tricks your interested hosts (and the switch) that your machine MAC address now owns the IP of the old IP gateway by sending out a "gratuitous arp". The interesting machines will unwittingly send all gateway/default route destined traffic to your machine. Your machine will now forward packets through its IP stack as if it was the gateway.

Where this won't work is when "port security" has been enabled on the switch, a not uncommon practice. This is to stop arp poisoning by blocking gratuitous arps where an IP is moving from one Ethernet port to another.

share|improve this answer
add comment

If your switch(es) support it you can configure port mirroring/monitoring which will allow the switch to mirror traffic on the monitored ports to the monitor port.

http://en.wikipedia.org/wiki/Port_mirroring

share|improve this answer
    
+1. This is a pretty standard way of going about this without interrupting the end-user or putting the target NIC into the somewhat worrisome promiscuous mode. –  MDMarra Oct 25 '12 at 18:48
add comment

It's not about the tool, it's about capturing from a device which is in the traffic path you're interested in. Since switches only transmit packets on the ports they are destined for, and edge device is not going to see traffic between two other devices. The usual approach is to capture from a device which is either a bridge or router for the target device.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.