?
Solved

How to snif packets of another pc in my network??

Posted on 2009-07-15
3
Medium Priority
?
645 Views
Last Modified: 2012-05-07
How to snif packets of another pc in my network??
0
Comment
Question by:rodstevens
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
3 Comments
 
LVL 16

Accepted Solution

by:
SteveJ earned 2000 total points
ID: 24866211
1) If the PC you want to sniff is plugged into a hub (likely, it is not) then simply plug your PC running wireshark into the same hub and capture the data.

2) If the PC you want to sniff is plugged into a switch, AND the switch has port mirroring capability you can mirror all of the traffic onto another port and plug your PC into the port you've sent the mirrored traffic into and capture the data.

3) If the switch doesn't have port mirroring capability AND you have a hub, you can cable the PC you want to sniff into the hub, then cable the hub into the switch . . . then plug your PC into the hub and capture data.

4) If you can't do 1, 2, or 3 you will need to download Cain and Able (or a similar product) that allows you to do ARP cache poisoning. This will essentially allow you to be a surreptitious man-in-the-middle.

That said, no offense, but if you can't pull off 1, 2 or 3 you will probably have trouble with the ARP cache poisoning solution. It's a non-trivial task to set up properly and Cain and Able isn't a very user friendly product if you are not more or less network savvy.

Good luck,
SteveJ
0
 
LVL 32

Expert Comment

by:Kamran Arshad
ID: 24866954
Hi,

Nicely mentioned in the above comment. Tell the exact model of your switch. It will help you a lot in checking if it supports port-mirroring. Also you can purchase a hub which can always be useful in such diagnostic purposes. Hub is really very inexpensive these days and you can get one for low price.
0
 
LVL 12

Expert Comment

by:jahboite
ID: 24867862
Great answer from SteveJ.  I'd just add that if 1, 2 or 3 aren't an option and you feel like attempting 4 then there's some basics of ARP poisoning here:

http://www.irongeek.com/i.php?page=security/arpspoof

and an excellent video tutorial at the same site:

http://www.irongeek.com/i.php?page=videos/using-cain-to-do-a-man-in-the-middle-attack-by-arp-poisoning
0

Featured Post

2017 Webroot Threat Report

MSPs: Get the facts you need to protect your clients.
The 2017 Webroot Threat Report provides a uniquely insightful global view into the analysis and discoveries made by the Webroot® Threat Intelligence Platform to provide insights on key trends and risks as seen by our users.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article is a collection of issues that people face from time to time and possible solutions to those issues. I hope you enjoy reading it.
This article is in regards to the Cisco QSFP-4SFP10G-CU1M cables, which are designed to uplink/downlink 40GB ports to 10GB SFP ports. I recently experienced this and found very little configuration documentation on how these are supposed to be confi…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Michael from AdRem Software outlines event notifications and Automatic Corrective Actions in network monitoring. Automatic Corrective Actions are scripts, which can automatically run upon discovery of a certain undesirable condition in your network.…
Suggested Courses

770 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question