Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been always worrying about using HTTPS in all sites and using secure connections in Messenger, Email, etc, because I don't want people being able to read my private info or hacking my sessions on sites, in shared networks.

However, I would like to try myself doing the same, just to see how easy it is to do what I've been worrying about.

The thing is, Wireshark can only sniff what my computer receives and sends. Or, if I make everything obviously insecure in a private network for Wireshark to be able to get the packets.

I assume that is because routers are not hubs anymore, not broadcasting anymore, sending the packets directly to the destination.

So my questions are:

1) Does it make sense at this time to worry about someone tracking what I'm doing on the Internet in a shared network?

2) If so, how do I sniff traffic from other computers in a shared network?

I'm not saying I'm going to discard the importance of HTTPS. I fully know the importance of it. However, not all sites or services provide secure connections, and those are what I worry about, avoiding using them in a shared network.

share|improve this question
up vote 3 down vote accepted

I'll start by saying that switches do offer greater security then hubs, but they are no panacea.

If I were malicious and on your LAN, I might try and act like a router - which would work particularly well, for example, if I run a DHCP server which can respond before your regular server, thus changing the traffic flow through my box so I can sniff it.

If I'm an ISP between you and the target site, I can intercept traffic on the wire and read (and modify !) it. If I were simply interested in watching what you were doing I could simply turn on a monitoring port on my (managed, standard-in-ISP environment) switch and read your output from it.

Of-course, even if I were evil and in your home, I could silently replace your switch with one which does my bidding to intercept traffic - or recable for similar effect. Of-Course, I could alternatively target the router and just sniff traffic from there.

Thus the only way to prevent (or largely prevent) others sniffing traffic in your network is to do end-to-end encryption - for example HTTPS (as you say) or using a VPN between endpoints. [ Or if I don't care what people halfway around the world think and am only worried about local threats, just getting a VPN provider to bounce all my traffic through ].

Even using HTTPS or equivalent, your data is still not totally anonymous - you need to be careful about leakage - for example you can still see the target IP address when sniffing HTTPS traffic, and if the DNS lookup chain is compromised the website. I might even be able to get a general indication of what you are looking at based on the size of packets you are transmitting and receiving and their frequency. Of-Course, I could also attempt a man-in-the-middle attack if you are not eternally vigilant - Moxy Marlinspike has some excellent stuff on hacking HTTPS connections if you want to explore this element further.

share|improve this answer
Switches don't send packets to everyone for bandwidth reasons. Don't confuse this with security - unless something is designed as a security feature, it's a bad idea to rely on it. Also, wifi does literally broadcast your packets over the air, so you might need to worry about that. And upstream people can see what you're doing, as can anyone who can tamper with your network hardware. – cpast Mar 18 '13 at 22:05
Agreed - "Don't rely on security through obscurity"... "All security is ultimately provided through obscurity". – davidgo Mar 18 '13 at 22:09
Thank you for your comments about this topic. Some of the stuff (like ISP and Man in the Middle) I already knew. I'm more focused on people like me in this shared network. @cpast So, do you mean that if everyone in this shared network is using wifi, I should be able to sniff their traffic? – Nuno Peralta Mar 18 '13 at 23:35
@Nuno Generally, yes. Not certain how it works on secured networks, but with the right drivers for your wifi card, you can view all packets sent (this is how aircrack works; it's called "promiscuous mode") – cpast Mar 19 '13 at 1:04

A) Yes and no depending on who they are... Do they work in IT? Do they need access to certain applications? Is that person interesting in pen-testing? What’s the reason for sniffing YOUR packets?

B) I’m not sure about wireshark but packages such as airodump-ng can sniff all the data in the network using monitor mode and I know that wireshark supports promiscuous mode allowing it to read packets not intended for it.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .