How can I monitor the TCP/IP (or HTTP) traffic of a remote machine?

Question

Are there any applications (preferably free) for windows OS using which I can monitor the TCP/IP traffic of a remote machine (in the same intranet)?

Answer 1

• Do you have access on the remote Windows machine?
  • If yes, there are a lot of ways you could do monitoring (depending on the depth of your requirements)
  • For example you could execute wireshark on the remote machine too
• If you do not have access on that machine,
  • You are limited to what can be tapped on the network
  • Which requires access to the network
    (networks today typically do not broadcast any traffic, so snooping is difficult)
• However, if you have access to the network devices, you could snoop over them
  • One example (already noted in another answer here) is to setup a proxy in the path
    • the Squid proxy has very good ways to track web activity (with some more tools)
  • Another is to mirror traffic for the user's port from one of the switches on the network.
  • Once you get a tap in the network path, a lot of options open up again

Assuming you are administering the network and probably the Windows machine in question,
You would have one of the above things workable.

Answer 2

Are you looking to monitor the URLs that they visit or malicious traffic in HTTP payloads?

If the former, use a proxy on the gateway device and set logging and make the proxy transparent.

If the latter use a managed Anti-virus suite.

Answer 3

If you want a detailed in depth analysis of content the you can use:

http://www.ethereal.com/

Both tools are free and quite powerfull.

Answer 4

Without resorting to ARP poisoning, you would need to use a proxy server or monitor traffic at the router/gateway. The only time we've had to do this was with logs at the proxy server due to accountability issues we're mandated to follow.

If you use a proxy like Squid you can then just parse the logfiles.

Answer 5

tcpdump nmap wireshark

Answer 6

If you have a managed switch between you and the remote machine you can simply mirror the traffic to the local machine and then use any monitor software with some suitable filter see How to monitor remote traffic