This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Sniffing Ethernet networks

0

I was wondering is it possible to capture the packets of other computers on a cable network ? if so is it possible to do it by windows or like wifi windows can't sniff packets from other computers and doesn't support monitor mode ?

asked 27 Jul '13, 12:18

Milad%20Rad's gravatar image

Milad Rad
16224
accept rate: 0%

edited 27 Jul '13, 23:39

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196

1

By "cable network" do you mean "a network that uses a cable rather than a radio", such as an Ethernet network, or do you mean "a network provided by a cable television company", so that you'd be trying to sniff the traffic of other cable modem subscribers?

(27 Jul '13, 13:19) Guy Harris ♦♦

I mean Ethernet like a lan network based on cables in an office

(27 Jul '13, 22:22) Milad Rad

One Answer:

2

There is no such thing as "monitor mode" for Ethernet. There is, for Ethernet and Wi-Fi (and other technologies, such as Token Ring and FDDI), "promiscuous mode", which is supported by most Ethernet adapters and is supported by most Ethernet drivers and by most packet capture mechanisms, including WinPcap on Windows.

However, it may not be sufficient to be in promiscuous mode if you're capturing on a switched network. This is discussed in detail on the Ethernet capture page on the Wireshark Wiki.

answered 27 Jul '13, 23:50

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%