4 ms·

I never understood how to intercept another device's TCP packets. Do you connect some sort of device in between the device and the network as a node or is the o

I never understood how to intercept another device's TCP packets. Do you connect some sort of device in between the device and the network as a node or is the only requirement is to be connected in the same hub? Does anyone have reading material on how to do this?

TheAceOfHearts 8y ago
I telnet into my router and run tcpdump, then I use FTP to copy the file from the router to my computer and import it to Wireshark in order to inspect it.
DaOne256 8y ago
You must connect an old network hub to the device you want to listen to (or its Wifi access point) and your PC that is running WireShark. A hub is like a switch that sends every received data to all of its ports.
johngalt 8y ago
Either you run wireshark directly on the endpoint, or you setup some means of tapping into the traffic. The most common method is to use a managed switch to setup a mirror port. Basically you tell the switch to copy all traffic and send it out on an extra port and then capture traffic while connected to that port.
planteen 8y ago
Wireshark has a document: https://wiki.wireshark.org/CaptureSetup/Ethernet https://wiki.wireshark.org/CaptureSetup/Ethernet I personally use a hub. You are limited to 10 or 100 Mbps (no gigabit hubs exist). I typically am debugging embedded systems, so inserting a hub into the mix is trivial and easier than trying to login to a managed switch. No tracing in the data closet or calls to IT required.
pnutjam 8y ago
A hub will limit your speed significantly. They aren't usually bidirectional. I used to use a linux PC with multiple ports. You can enable port forwarding and capture traffic as it passes through. Use a 3rd port to access it. However, I've recently acquired a managed 5 port switch. I didn't know these were available, but they are awesome and pretty cheap. Example: https://www.amazon.com/TP-Link-Ethernet-Sheilded-Replacement-TL-SG105E/dp/B00N0OHEMA https://www.amazon.com/TP-Link-Ethernet-Sheilded-Replacement...
brandonsometig 8y ago
Port mirroring on most managed switches will allow you to pick up TCP packets for another device.
berti 8y ago
There is a such a thing as an Ethernet tap (basically, you tap one pair to Rx on a NIC, and if you want both ways you need another NIC)... but it's tricky to avoid impedance mismatch etc, and not feasible at all for Gigabit Ethernet. The simple/easy option is configure port mirroring on your switch[1] as mentioned by other commenters. [1] https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_55_se/configuration/guide/scg_2960/swspan.html https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2...

TheAceOfHearts 8y ago

I telnet into my router and run tcpdump, then I use FTP to copy the file from the router to my computer and import it to Wireshark in order to inspect it.

DaOne256 8y ago

You must connect an old network hub to the device you want to listen to (or its Wifi access point) and your PC that is running WireShark. A hub is like a switch that sends every received data to all of its ports.

johngalt 8y ago

Either you run wireshark directly on the endpoint, or you setup some means of tapping into the traffic. The most common method is to use a managed switch to setup a mirror port. Basically you tell the switch to copy all traffic and send it out on an extra port and then capture traffic while connected to that port.

planteen 8y ago

Wireshark has a document: https://wiki.wireshark.org/CaptureSetup/Ethernet https://wiki.wireshark.org/CaptureSetup/Ethernet I personally use a hub. You are limited to 10 or 100 Mbps (no gigabit hubs exist). I typically am debugging embedded systems, so inserting a hub into the mix is trivial and easier than trying to login to a managed switch. No tracing in the data closet or calls to IT required.

pnutjam 8y ago

A hub will limit your speed significantly. They aren't usually bidirectional. I used to use a linux PC with multiple ports. You can enable port forwarding and capture traffic as it passes through. Use a 3rd port to access it. However, I've recently acquired a managed 5 port switch. I didn't know these were available, but they are awesome and pretty cheap. Example: https://www.amazon.com/TP-Link-Ethernet-Sheilded-Replacement-TL-SG105E/dp/B00N0OHEMA https://www.amazon.com/TP-Link-Ethernet-Sheilded-Replacement...

brandonsometig 8y ago

Port mirroring on most managed switches will allow you to pick up TCP packets for another device.

berti 8y ago

There is a such a thing as an Ethernet tap (basically, you tap one pair to Rx on a NIC, and if you want both ways you need another NIC)... but it's tricky to avoid impedance mismatch etc, and not feasible at all for Gigabit Ethernet. The simple/easy option is configure port mirroring on your switch[1] as mentioned by other commenters. [1] https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_55_se/configuration/guide/scg_2960/swspan.html https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2...