2

Let's say sniff program is installed on computer A. And let's say I am looking at a Youtube video on the computer B.

Can the sniff program see what computer B is doing?

If that's possible, witch sniffing program can do that? I use Ubuntu if that helps.

Improve this question

4 Answers 4

Reset to default
5

Yes, it is possible. There are several ways:

  1. Connect your two PCs using a hub. All traffic will be sent to all ports.
  2. Use a man-in-the-middle attack program like ethercap.
  3. Use port-mirroring feature in a managed switch to forward all traffic from another port.

You can use tcpdump or wireshark for packet capturing.

I am assuming both hosts are located in the same LAN.

Improve this answer
3
  • I tried wireshark but I dont get how works. I only can sniff my own computer. Idk how to sniff the other computer.
    – TheDegree0
    Dec 3, 2011 at 15:10
  • you need to be receiving traffic meant for other hosts, due to one of the conditions khaled outlined.
    – Sirex
    Dec 3, 2011 at 15:34
  • 1
    ARP poisoning is a mechanism for man-in-the-middle attack as mentioned above. A note for reference.
    – Bart Silverstrim
    Dec 3, 2011 at 22:02
3

Check out Wireshark.

Improve this answer
3

This can't be done on a switched network, because (by definition of Ethernet switching) on these networks each switch port only receives frames addressed to devices connected to that port; so your computer will not get a copy of the frames addressed to other devices, and any network sniffer running on it will not be able to examine those frames.

You can work around this limitation if you have some kind of control on the networking equipment and/or layout:

  • You can place a hub between the network switch and the device whose traffic you want to capture, and connect your PC to that hub; hubs forward all traffic to all ports, so your computer will get a copy of all traffic flowing through the hub.
  • You can configure the network switch (if it supports this feature) to forward a copy of some or all traffic to a specific "monitor" port, and then you can connect your computer to that port; with this setup, your computer will receive a copy of the traffic you want to monitor.

About the sniffing program itself, the best one around is WireShark. It's available for both Linux and Windows.

Improve this answer
1
  • 1
    Don't forget ARP poisoning!
    – Shane Madden
    Dec 3, 2011 at 19:11
1

I should point out - the Wireshark solution allows you to see what packets are being sent/received. It won't let you, say, watch the same YouTube video, unless you're much more sophisticated than you're likely to want to be.

The way your question is worded it sounds like you might be more interested in whether spyware/employee monitoring can be done remotely without an agent on your machine. And that's possible, but requires a level of technical sophistication your employer isn't likely to have/want/do.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .