Hacker News Reader

Comment by syntaxing | Hacker News Reader

I never understood how to intercept another device's TCP packets. Do you connect some sort of device in between the device and the network as a node or is the only requirement is to be connected in the same hub? Does anyone have reading material on how to do this?

View on HN

Either you run wireshark directly on the endpoint, or you setup some means of tapping into the traffic.

The most common method is to use a managed switch to setup a mirror port. Basically you tell the switch to copy all traffic and send it out on an extra port and then capture traffic while connected to that port.

Port mirroring on most managed switches will allow you to pick up TCP packets for another device.

Wireshark has a document: https://wiki.wireshark.org/CaptureSetup/Ethernet

I personally use a hub. You are limited to 10 or 100 Mbps (no gigabit hubs exist). I typically am debugging embedded systems, so inserting a hub into the mix is trivial and easier than trying to login to a managed switch. No tracing in the data closet or calls to IT required.

There is a such a thing as an Ethernet tap (basically, you tap one pair to Rx on a NIC, and if you want both ways you need another NIC)... but it's tricky to avoid impedance mismatch etc, and not feasible at all for Gigabit Ethernet. The simple/easy option is configure port mirroring on your switch[1] as mentioned by other commenters.

[1] https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2...

A hub will limit your speed significantly. They aren't usually bidirectional. I used to use a linux PC with multiple ports. You can enable port forwarding and capture traffic as it passes through. Use a 3rd port to access it. However, I've recently acquired a managed 5 port switch. I didn't know these were available, but they are awesome and pretty cheap. Example: https://www.amazon.com/TP-Link-Ethernet-Sheilded-Replacement...

You must connect an old network hub to the device you want to listen to (or its Wifi access point) and your PC that is running WireShark. A hub is like a switch that sends every received data to all of its ports.

I telnet into my router and run tcpdump, then I use FTP to copy the file from the router to my computer and import it to Wireshark in order to inspect it.

Reply on news.ycombinator.com