Wireshark Help!

[KraftDinner]

I'm trying to get a grasp on networking and a great administrative tool is Wireshark, I find it super helpful analyzing all the protocols it helps me really understand how it all comes together. But it seems like I'm only getting captures from my local machine, is there a way to capture all network traffic within a LAN? I basically want to analyze all traffic on my home network over wireless, not ethernet, I can't seem to capture anything except for traffic on my local machine, could someone please clarify? Thanks!

 

EDIT: I should probably clarify that I've done tons of packet captures with wireshark over wired connections, but im really curious and determined to get it working of wireless now 

[Decon]

I'm trying to get a grasp on networking and a great administrative tool is Wireshark, I find it super helpful analyzing all the protocols it helps me really understand how it all comes together. But it seems like I'm only getting captures from my local machine, is there a way to capture all network traffic within a LAN? I basically want to analyze all traffic on my home network over wireless, not ethernet, I can't seem to capture anything except for traffic on my local machine, could someone please clarify? Thanks!

I wouldn't recommend learning how a LAN works with wireshark lol .___.

[AnnoyedShelf]

I'm trying to get a grasp on networking and a great administrative tool is Wireshark, I find it super helpful analyzing all the protocols it helps me really understand how it all comes together. But it seems like I'm only getting captures from my local machine, is there a way to capture all network traffic within a LAN? I basically want to analyze all traffic on my home network over wireless, not ethernet, I can't seem to capture anything except for traffic on my local machine, could someone please clarify? Thanks!

Yeah this is not a great way to learn.  Not sure how well wireless capture even works on wireshark, in all of my networking classes we always use it on a wired connection.

[KraftDinner]

I wouldn't recommend learning how a LAN works with wireshark lol .___.

 

 

Yeah this is not a great way to learn.  Not sure how well wireless capture even works on wireshark, in all of my networking classes we always use it on a wired connection.

Yeah I know what you guys are saying, I should've clarified that I have messed around plenty with wireshark on a wired connection. I set up a switch and traced all the packets flowing through which worked flawlessly it was awesome. I honestly just want to know how to trace it over a wireless network for shits and giggles / curiosity 

[Wombo]

I'm trying to get a grasp on networking and a great administrative tool is Wireshark, I find it super helpful analyzing all the protocols it helps me really understand how it all comes together. But it seems like I'm only getting captures from my local machine, is there a way to capture all network traffic within a LAN? I basically want to analyze all traffic on my home network over wireless, not ethernet, I can't seem to capture anything except for traffic on my local machine, could someone please clarify? Thanks!

 

EDIT: I should probably clarify that I've done tons of packet captures with wireshark over wired connections, but im really curious and determined to get it working of wireless now 

Most managed switches can do this. In the Cisco world it is called SPAN, RSPAN, or ERSPAN. Essentially it can replicate the traffic, ingress or egress, and sends it to a designated destination.

 

There are several limitations on this however and it is a higher-end switch feature, not available on any consumer gear that I know of.

 

The best bet if you want to see everything that is going on would be to use a hub but those are well... legacy.

[leadeater]

I'm trying to get a grasp on networking and a great administrative tool is Wireshark, I find it super helpful analyzing all the protocols it helps me really understand how it all comes together. But it seems like I'm only getting captures from my local machine, is there a way to capture all network traffic within a LAN? I basically want to analyze all traffic on my home network over wireless, not ethernet, I can't seem to capture anything except for traffic on my local machine, could someone please clarify? Thanks!

 

EDIT: I should probably clarify that I've done tons of packet captures with wireshark over wired connections, but im really curious and determined to get it working of wireless now 

 

Yes, use a switch that supports port mirroring. Mirror the ports you want to analyse to the port that you have the wireshark capture computer plugged in to. Also a lot of network devices support packet traces and dumps to files for analysing in tools like wireshark etc.

[KraftDinner]

Most managed switches can do this. In the Cisco world it is called SPAN, RSPAN, or ERSPAN. Essentially it can replicate the traffic, ingress or egress, and sends it to a designated destination.

 

There are several limitations on this however and it is a higher-end switch feature, not available on any consumer gear that I know of.

 

The best bet if you want to see everything that is going on would be to use a hub but those are well... legacy.

 

 

Yes, use a switch that supports port mirroring. Mirror the ports you want to analyse to the port that you have the wireshark capture computer plugged in to. Also a lot of network devices support packet traces and dumps to files for analysing in tools like wireshark etc.

 

Awesome sounds good, I'm going to try and mirror the ports. Wouldn't the fact that you have to mirror the port in order to get a full network packet capture make it really hard for a random guy to capture packets on your LAN? Yet somehow people still manage to do it, how do they pull this off? I've been reading about security and networking a lot so I'm super curious haha

[Wombo]

Awesome sounds good, I'm going to try and mirror the ports. Wouldn't the fact that you have to mirror the port in order to get a full network packet capture make it really hard for a random guy to capture packets on your LAN? Yet somehow people still manage to do it, how do they pull this off? I've been reading about security and networking a lot so I'm super curious haha

Ya that's the joy of switches. You only get the traffic that is addressed to you. This is one of the main reasons hubs went bye bye.

 

A typical attack involving switched networks would be ARP spoofing (for man in the middle) where an attackers machine sends dhcp/bootp messages claiming that it is the default gateway for the network. This can be mitigated with some switch security features. Another common attack is to flood the switch with ARP messages until its CAM table overflows and it can no longer learn MAC addresses, this will cause the switch to function like a hub. This can also be mitigated through switch security features.

[KraftDinner]

Ya that's the joy of switches. You only get the traffic that is addressed to you. This is one of the main reasons hubs went bye bye.

 

A typical attack involving switched networks would be ARP spoofing (for man in the middle) where an attackers machine sends dhcp/bootp messages claiming that it is the default gateway for the network. This can be mitigated with some switch security features. Another common attack is to flood the switch with ARP messages until its CAM table overflows and it can no longer learn MAC addresses, this will cause the switch to function like a hub. This can also be mitigated through switch security features.

Awesome, thanks man!