How to set specific broadcast IP address on Windows

Question

Problem:

I have a machine Sender, that sends packages to a certain IP address in a local network. I have also machines A, B, C, etc, connected to the same local network. I want these machines to listen to the packets from Sender inside, lets say, a python script. Also, I cannot change the target IP address of the packets sent by Sender.

Question:

A simple solution I thought was to set a custom broadcast IP on machines A, B, C..., so they would listen to that IP address where packets are being sent. This can be done in Linux using the command ifconfig, afaik.

However, these machines run Windows. How could I set a custom Broadcast IP on these machines?

Answer 1

The solution to your question depends on a number of circumstances.

Capturing inside Sender

1. If you want to capture data directly inside in Sender, use a special capture driver that is included with the Wireshark or Tshark installation. Captured data can be stored in a file and shared over the network.
2. Wireshark can capture data even "remotely". See Remote Packet Capture with Wireshark:
   https://www.golinuxcloud.com/wireshark-remote-packet-capture/
   https://www.comparitech.com/net-admin/tcpdump-capture-wireshark/

3. Wireshark can also read captured packets from another application in real time. This is useful if you want to watch a network in real time, and Wireshark cannot capture from that network, e.g. because it is not a network type supported by the version of libpcap/WinPcap on your machine, or because you want to capture traffic on an interface on another machine and your version of libpcap/WinPcap doesn't support remote capturing from that machine.
   Python on Windows
   The following small Python script shows how to use Python on Windows... https://wiki.wireshark.org/CaptureSetup/Pipes

Other possibilities outside the Sender

1. What network element makes up your network? If it is a switch, then the communication between the Sender and another network node (X) cannot be intercepted by machines A, B, C at all. The switch sends data frames only between the ports of the communicating pair Sender<-->X. Exceptions are broadcasts in IPv4 communication. These are usually used only when initiating a connection or requesting an IP address: ARP request, DHCP discover, etc.
2. Broadcasts usually represent only a fraction of the total volume of communication, and you do not need any special settings to capture them, they spread throughout the network and can be heard by all nodes in the broadcast domain.
3. Receiving broadcast packets will give you only little information. Broadcasts are not designed to transfer larger volumes of data, they have an auxiliary service function, e.g. when establishing a connection.
4. No setting done only on machines A, B, C will not achieve that A, B, C can receive a copy of the unicast (i.e. non-broadcast) communication between the Sender and node X. Exceptions are methods of network attack, in which you attack a switch and force it to go into flood mode. Or you attack the Sender and force it to send a copy of the communication to other nodes (A, B, C...).
5. A proper and commonly used method to obtain a copy of network communication on another node outside the communicating pair is to mirror the ports on the switch. It requires having a managed switch and setting up a monitoring instance consisting of source and destination switch ports. Nodes A, B, C then connect to the target monitoring ports and receive a copy of what Sender sends (and receives).
6. Bulk long-term data transfer from the source to multiple nodes is solved using multicasting. It is a special type of communication that uses multicast target addresses. Depending on the type of mode (sparse mode / dense mode, etc.), clients receive the stream of data automatically or after they subscribe to it. Multicast is most often used for multimedia (audio/video) data streams.

Answer 2

In IPV4, setting a 'custom' broadcast address is the same as setting a broadcast address for a 'custom' subnet.

The smallest legal subnet is now /31. 255.255.255.254, but most versions of Windows won't easily let you set that. But you can use .252

If your target is at the legal broadcast address for that range (xxx.xxx.xxx.bbbbbb11), then anything in that subnet will see the broadcast. The target doesn't need to know that it's at the broadcast address for a small subnet, and the mirrors aren't limited to being in only one subnet: follow down to the adapter settings from IPV4 to 'advanced' and ADD another address and subnet. Yes, this limits the target IP to 1 address in 4, but that's what you get for abusing a system beyond it's original design limits.

The reason that the world is moving to 'multicast' is that it works better than 'broadcast', including the fact that the original 'socket' api wasn't really intended for multiple adapters or multiple subnets. Even if you get it working,it will be fragile.