0

I couldn't find an answer yet I hope its not just the way I searched google. I have a computer connected to a router via Ethernet exit. my promiscuous mode is on but I don't see other devices connected to my network in PCAPs, I only see my device and broadcast packets. Also my computer is running Ubuntu 14 I use: 

tshark -i eth1 -f "host <some ip>" -w <path> &

to record the network

Thanks

dor
  • 1

1 Answers1

1

Because that is not how Ethernet works!

Your router's integrated ethernet switch only routes broadcast packets and packets that were meant for your PC's MAC address to you. The others, by design, never reach you.

You'd need to do the packet sniffing on your router, or get a managed switch with a monitoring port; downside of that might be the additional cost of a switch with mirroring port, and the fact that this single mirroring port might limit the bandwidth of your network (which, in a home network sense, wouldn't be an issue, normally).

Marcus Müller
  • 5,843
  • 2
  • 16
  • 27
  • No problem - it always surprises me how cheap some powerful kit can be. I've used a 5 port switch to monitor multiple machines by putting it between larger switches which don't have monitoring, although the computer I was using to look at the data struggled in some cases. – Matthew Aug 16 '17 at 10:46