Home / server / Questions / 337330
In Process
TheDegree0
Asked: 2011-12-04 06:32:21 +0800 CST

Can I read data being sent to/from other computers?

  • 772

Let's say sniff program is installed on computer A. And let's say I am looking at a Youtube video on the computer B.

Can the sniff program see what computer B is doing?

If that's possible, witch sniffing program can do that? I use Ubuntu if that helps.

packet-sniffer sniffing

4 Answers

  1. Yes, it is possible. There are several ways:

    1. Connect your two PCs using a hub. All traffic will be sent to all ports.
    2. Use a man-in-the-middle attack program like ethercap.
    3. Use port-mirroring feature in a managed switch to forward all traffic from another port.

    You can use tcpdump or wireshark for packet capturing.

    I am assuming both hosts are located in the same LAN.

    • 5

  2. Check out Wireshark.

    • 3

  3. This can't be done on a switched network, because (by definition of Ethernet switching) on these networks each switch port only receives frames addressed to devices connected to that port; so your computer will not get a copy of the frames addressed to other devices, and any network sniffer running on it will not be able to examine those frames.

    You can work around this limitation if you have some kind of control on the networking equipment and/or layout:

    • You can place a hub between the network switch and the device whose traffic you want to capture, and connect your PC to that hub; hubs forward all traffic to all ports, so your computer will get a copy of all traffic flowing through the hub.
    • You can configure the network switch (if it supports this feature) to forward a copy of some or all traffic to a specific "monitor" port, and then you can connect your computer to that port; with this setup, your computer will receive a copy of the traffic you want to monitor.

    About the sniffing program itself, the best one around is WireShark. It's available for both Linux and Windows.

    • 3

  4. I should point out - the Wireshark solution allows you to see what packets are being sent/received. It won't let you, say, watch the same YouTube video, unless you're much more sophisticated than you're likely to want to be.

    The way your question is worded it sounds like you might be more interested in whether spyware/employee monitoring can be done remotely without an agent on your machine. And that's possible, but requires a level of technical sophistication your employer isn't likely to have/want/do.

    • 1