Can I read data being sent to/from other computers?

Question

Let's say sniff program is installed on computer A. And let's say I am looking at a Youtube video on the computer B.

Can the sniff program see what computer B is doing?

If that's possible, witch sniffing program can do that? I use Ubuntu if that helps.

score 5 · Answer 1 · answered Dec 03 '11 at 14:41

5

Yes, it is possible. There are several ways:

Connect your two PCs using a hub. All traffic will be sent to all ports.
Use a man-in-the-middle attack program like ethercap.
Use port-mirroring feature in a managed switch to forward all traffic from another port.

You can use tcpdump or wireshark for packet capturing.

I am assuming both hosts are located in the same LAN.

answered Dec 03 '11 at 14:41

Khaled

35,688
8
69
98

I tried wireshark but I dont get how works. I only can sniff my own computer. Idk how to sniff the other computer. – TheDegree0 Dec 03 '11 at 15:10
you need to be receiving traffic meant for other hosts, due to one of the conditions khaled outlined. – Sirex Dec 03 '11 at 15:34
1

ARP poisoning is a mechanism for man-in-the-middle attack as mentioned above. A note for reference. – Bart Silverstrim Dec 03 '11 at 22:02

score 3 · Answer 2 · answered Dec 03 '11 at 14:41

3

Check out Wireshark.

answered Dec 03 '11 at 14:41

HTTP500

4,827
4
22
31

score 3 · Answer 3 · answered Dec 03 '11 at 15:00

This can't be done on a switched network, because (by definition of Ethernet switching) on these networks each switch port only receives frames addressed to devices connected to that port; so your computer will not get a copy of the frames addressed to other devices, and any network sniffer running on it will not be able to examine those frames.

You can work around this limitation if you have some kind of control on the networking equipment and/or layout:

You can place a hub between the network switch and the device whose traffic you want to capture, and connect your PC to that hub; hubs forward all traffic to all ports, so your computer will get a copy of all traffic flowing through the hub.
You can configure the network switch (if it supports this feature) to forward a copy of some or all traffic to a specific "monitor" port, and then you can connect your computer to that port; with this setup, your computer will receive a copy of the traffic you want to monitor.

About the sniffing program itself, the best one around is WireShark. It's available for both Linux and Windows.

Don't forget ARP poisoning! – Shane Madden Dec 03 '11 at 19:11 — Shane Madden, Dec 03 '11 at 19:11

score 1 · Answer 4 · answered Dec 03 '11 at 14:55

I should point out - the Wireshark solution allows you to see what packets are being sent/received. It won't let you, say, watch the same YouTube video, unless you're much more sophisticated than you're likely to want to be.

The way your question is worded it sounds like you might be more interested in whether spyware/employee monitoring can be done remotely without an agent on your machine. And that's possible, but requires a level of technical sophistication your employer isn't likely to have/want/do.

Can I read data being sent to/from other computers?

4 Answers4