Silently start Wireshark

Question

I have a computer in our office that always gets infected by viruses. Because of this, I would like to use Wireshark (or at least something) to monitor internet traffic for a while on this machine. How can I have it start at boot time and begin monitoring without the user interface popping up? I would like to have this begin silently so that he does not know we are monitoring his traffic.

EDIT Sorry, it is Windows XP.

You're going to need to let us know what operating system you are using before anybody can answer this! — Caleb, Apr 25 '11 at 18:56
If you want to do something silently you probably should be looking at running tshark or [windump](http://www.winpcap.org/windump/). No point in starting a GUI app in the background when you don't need to. — Zoredache, Apr 25 '11 at 18:58
You could also use a monitor port on your switch. Also, you should probably make your employer aware of this. There may be legal implications for monitoring your users this way. — Brad, Apr 25 '11 at 19:00
There shouldn't be any legal implications, we signed paperwork saying our internet traffic may be monitored at any time (though I know for a fact we haven't been packet monitoring since I've been here at least) — codewario, Apr 25 '11 at 19:04

score 6 · Accepted Answer · answered Apr 25 '11 at 19:31

If it is an internal box, then there should be a server acting as his gateway to the internet. Set up wireshark to monitor the traffic on this box, with a rule set for only his ip address.

Alternatively, if you don't have a central node to watch across, set up ettercap and start an arp poisoning. His machine will silently send traffic to you, which you silently pass on. There will be a performance hit on his end, but you get that with wireshark as well.

If you want to start wireshark silently in the background on his machine, you need to realize that wireshark is natively a GUI application. As Zoredache noted, you may want to use a command line based tool instead. The only option I can come up with is noted here: http://www.wireshark.org/docs/man-pages/wireshark.html

Set the display variable to be something other than the primary display. Most likely, an X11 session forwarded over ssh. This option will not be available in windows.

I went ahead and set up Wireshark on our gateway with a filter rule for only his PC. I also installed it on my PC for poops and gigs and after playing around with it, it really is a nifty tool! — codewario, Apr 25 '11 at 19:33

score 3 · Answer 2 · edited Apr 13 '17 at 12:14

You're going to want a commandline call for this. For example, a download of something like windump. Then get a scheduled task that initiates on login, or periodically, if you want smaller hour-long dump files. (they can get big) The capture file will be viewable in WireShark.

The specific command line will likely be C:\foo\bar\windump.exe -i 1 -w C:\foo\bar\dumpfile.cap.

You'll also want to hide the scheduled task's command window.

Silently start Wireshark

2 Answers2