0

I have this scenario and I need some opinions from network experts. There is a way to monitor two computers from the same network without having administrator rights on the network ? I'm am on the office and I need see the traffic between two computers but unfortunately I am not the network admin. I don't need details just to see if that two computers have traffic on the network between them.

Thank you in advance !

Improve this question
1
  • 1
    Insure that you have permission from network admin, and users of the two computers. If not you will violate the computer miss use act (EU), or equivalent. If you don't have this legislation, then not in my and others opinion this legislation is useless (and dangerous), as everything in it was covered by existing legislation, except for some unintentional consequences.
    – ctrl-alt-delor
    Jun 29, 2016 at 8:43

2 Answers 2

Reset to default
1

If you have access to at least one of the computers, you can monitor the traffic between the two.

You get wireshark and install it on one of the computers. It will be able to show you all traffic of that computer, including the one towards the 2nd (target) computer. You will be able to select the desired traffic by filtering based on the IP address of the 2nd computer.

Improve this answer
2
  • How can I do that?
    – BurebistaRuler
    Jun 29, 2016 at 8:34
  • I have updated the answer.
    – Overmind
    Jun 29, 2016 at 8:38
1

You can add a third computer, though do not add it to the switch, as the switch will only send what is needed to each branch. Add it between one computer and the switch.

Using an old non-switching hub can be useful.

enter image description here

(as Hennes says, you can replace the switch and hub with a managed switch. However these are more expensive, and I am assuming that the switch already exists, and that you have no admin privileges to manage it. Another technique: if there is nothing else connected to the switch, then you can remove it)

A good bit of software is Wireshark.

As for permissions: The capture program dumpcap (part of wireshark) needs cap_net_admin, cap_net_raw (if your os uses the linux kernel), not full admin/root privileges.

Improve this answer
5
  • 1
    A little addition: Instead of using a whole computer as a Hub you can also do this with a managed switch. See port mirroring and similar terms.
    – Hennes
    Jun 29, 2016 at 8:49
  • I am not suggesting using a computer as a hub, though you could. The diagram has a hub as a hub. You are correct that if your switch is managed, then you may be able to configure it to do the hub bit as well. However if you can not get admin privileges this this can not be done. The cheapest is to put the monitor on A or B, but this need some admin rights when installing (not just because of the package manager, but because the tool needs elevated privileges). Also I have seen where there is a firewall on the machine with the monitor, I have got confusing results.
    – ctrl-alt-delor
    Jun 29, 2016 at 9:57
  • @richard I use a Mac for this job
    – BurebistaRuler
    Jun 29, 2016 at 10:14
  • Sniff, sniff sniff... Today you start to sniff and tomorrow and you will finish to be the old men in the middle. (@Hennes maybe I didn't really mean so old man in the middle :) ).
    – Hastur
    Jun 29, 2016 at 12:45
  • Hastur hastur hastur
    – Hennes
    Jun 29, 2016 at 13:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .