capture data packets in LAN

Question

in my college lab all the PCs are connected via LAN by L2 switch. i want to capture the http data packets by wireshark but it is only showing the interface of my own PC. so how can i capture the packets of other PCs.

can somebody tell me working of wireshark?

score 0 · Answer 1 · answered Mar 09 '13 at 06:23

0

It is in the nature of switches that you will only see either broadcast packets or traffic that has your MAC address as a destination, that is one of the crucial differences between a switch and a hub.

It is possible for most switches to be configured to copy traffic from one port to another, this is commonly done for monitoring purposes, but that has to be done via administrative access to the device.

answered Mar 09 '13 at 06:23

blankabout

2,597
2
18
29

and on top of this your LAN NIC must support this operation mode and it must be enabled (that's not normal situation). – SomeWittyUsername Mar 09 '13 at 06:40
i want to capture all data packets without access the switch, i think which seems abnormal? so any tool which can be used for such purpose. – krishan sethi Mar 09 '13 at 10:17
or i may be able to select the interface of local proxy because all the data passes through it...is it possible? – krishan sethi Mar 09 '13 at 10:20
You can only select an interface that's part of the machine on which {tcpdump,Wireshark.etc.} is running or, *if* the libpcap/WinPcap on your machine supports remote capture, an interface on a machine that's running the rpcap daemon. You can't select interfaces on other arbitrary machines. – Mar 30 '13 at 17:19

score 0 · Answer 2 · answered Mar 30 '13 at 12:50

You can manipulate the switch's behavior by means of ARP-Spoofing. But be cautious! Doing so might be seen as a criminal act.

So be sure that you're allowed to do so in the lab, sometimes that's OK if it serves the educational purpose. Ask your supervisor or the school's administrator.

My weapon of choice for such things is Ettercap.

A far less intrusive approach would be to use one of your own switches and configure it to forward all traffic. Then you can connect one port as an uplink to the lab's switch, one port to the device under test and one port to your machine running wireshark. (I would recommend using tcpdump for capturing, though.) If you don't have a manageable switch at hand, you can also use a router running OpenWRT.

capture data packets in LAN

2 Answers2