This is our old Q&A Site. Please post any new questions and answers at

I wanna capture packets from a remote computer, let say my friend is chatting with me, is it possible to capture all his ingoing and outgoing traffic by WireShark ?

asked 23 May '11, 05:18

nzhacker's gravatar image

accept rate: 0%

retagged 24 May '11, 15:56

helloworld's gravatar image


Yes or no, depending where your friend is. If he's right next to you, sharing a hub (not switch) with you that will "broadcast" all frames, you can capture everything. If he's on a switch or even at another location then no, you can't.

permanent link

answered 23 May '11, 05:31

Jasper's gravatar image

Jasper ♦♦
accept rate: 18%

I'm guessing at what you're wanting to accomplish, but if you are trying to help your friend resolve a problem and have their cooperation you can use "rpcapd" to do remote capture if you need to get all of the connection-type traffic, plus the upper-layer traffic.
If you are 'chatting' using something like Windows live messenger, and interested more in the actual message traffic, as I recall that traffic is sent in clear text, and your capture file will have both the incoming and outgoing traffic/text related to those messages in it without doing a remote capture on the other computer. Or as Jasper mentioned, you can use a hub at the remote location and capture all traffic broadcasted/received in parallel with the remote computer.

Hope this is helpful, John

permanent link

answered 23 May '11, 08:00

John_Modlin's gravatar image

accept rate: 0%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 23 May '11, 05:18

question was seen: 9,219 times

last updated: 24 May '11, 15:56

p​o​w​e​r​e​d by O​S​Q​A