This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hello. I have problems with a PC/PCS from my LAN network. One PC made spam on 25 port but i don't know who. My Network is like ex: ROUTER (with wan IP -xxx.xxx.xxx.xxx snd lan IP 192.168.1.1) and many PC's linked to router . I want to install whireshark on a pc from network (192.168.1.2) to monitoring the router to find what PC from LAN made spam on internet. How i can do that with WireShark?

asked 29 Apr '12, 06:47

luciffere's gravatar image

luciffere
1111
accept rate: 0%


Unless you can make your router mirror or span the traffic from other ports onto the port to which your Wireshark machine is connected then you will probably not be able to see the traffic as your router is most likely to be a switch and Wireshark will not be able to capture traffic from the other ports.

If you post some more info about your router (make and model) and your WAN type (DSL, Cable, Fibre) we may give you more help.

See the Capture Setup page on the Wiki for more info about capturing.

permanent link

answered 29 Apr '12, 10:11

grahamb's gravatar image

grahamb ♦
19.8k330206
accept rate: 22%

My router is ASUS WL520gc and the WAN type is:

WAN Type: Static
IP Address: 82.77.xxx.xxx
Subnet Mask: 255.255.255.224
Gateway: 82.77.xxx.xx
DNS Servers: 217.156.101.10


LAN Interface IP Address: 192.168.1.1 Subnet Mask: 255.255.255.0
Default Gateway: 192.168.1.1

(29 Apr '12, 10:42) luciffere

continue: Firmware Version: 2.0.1.1

(29 Apr '12, 10:43) luciffere

OK, that's a "Cable" type wireless router, with the stock firmware it won't mirror or span ports for either the wired or wireless traffic.

If you connected a hub or a switch that could mirror port on the WAN side then although you would be able to see the SPAM traffic, it's likely that the IP addresses of the traffic won't help as your Asus router will have NAT'd them to the WAN IP.

I think you are just going to have to visit each machine and inspect it for the SPAM traffic, either by installing Wireshark or looking at the output of netstat for connections on port 25.

(29 Apr '12, 13:23) grahamb ♦

as your router does not support port mirroring, there are two "cheap" options.

1.) Buy a cheap switch that is able to do port mirroring (e.g. HP ProCurve Switch 1810G-8, 8-Port, managed) and plug it between your router and the lan switch of your network. Then connect a sniffer to the mirrord port and filter on 'port 25'.

2.) Add a second network interface to your sniffer PC / Laptop and create a brigde between the two interface. Then connect the router to one interface and the lan switch to the other interface. Start sniffing on any one of the interfaces. DON'T switch off the PC/Laptop, as this will interrupt your internet connection. If you're done with sniffing, re-connect the router to the internal switch.

Create a Bridge with Windows 7
http://windows.microsoft.com/en-US/windows-vista/Create-a-network-bridge

Create a Bridge with Linux
http://www.linuxjournal.com/article/8172?page=0,0

Regards
Kurt

permanent link

answered 30 Apr '12, 16:24

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 30 Apr '12, 16:24

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×1,620
×33
×8

question asked: 29 Apr '12, 06:47

question was seen: 10,327 times

last updated: 30 Apr '12, 16:24

p​o​w​e​r​e​d by O​S​Q​A