1
1
It seems that I can only view my own packets, how to view other lan users packets via wireshark?
1
1
It seems that I can only view my own packets, how to view other lan users packets via wireshark?
0
You have to be connected through a device which all users pass traffic through to see their packets.
You can do this by passing traffic through a second NIC and using the computer as a router.
0
most likely you are using a network switch. switches keep track of the MAC addresses available on each port, and only send traffic out the port if the destination mac address is known to connect through it (or the traffic is an L2 Broadcast with dest mac of FF:FF:FF:FF:FF).
as a result, if your workstation is connected to port 1, the only traffic you will see is traffic between your NIC and that port on the switch. traffic from the device attached to port 2 will not ever exit port 1 unless it is addressed to your workstation.
This effect (microsegmentation) has many benifets, but it does prevent visibility to the entire network from any point.
Some network switches enable a technique called port mirroring, which is essentially a read only port that sends all traffic coming across the switch out the port. only managed switches have this feature.
alternately you can use a Hub, but that would really reduce the capability of your network.
the remaining option is to form a chokepoint where all the traffic passes through a device that can sniff it. proxy servers, or a computer configured as a router would suit this purpose.
1You have to either use a passive network tap or do some ARP spoofing. You only get frames destined for your MAC address, so you have to fool the switch to forward them to you. But that's considered pretty illegal to do and no one will be happy. – Ashtray – 2013-11-26T14:51:26.860