I have this scenario and I need some opinions from network experts. There is a way to monitor two computers from the same network without having administrator rights on the network ? I'm am on the office and I need see the traffic between two computers but unfortunately I am not the network admin. I don't need details just to see if that two computers have traffic on the network between them.

Thank you in advance !

  • 1
    Insure that you have permission from network admin, and users of the two computers. If not you will violate the computer miss use act (EU), or equivalent. If you don't have this legislation, then not in my and others opinion this legislation is useless (and dangerous), as everything in it was covered by existing legislation, except for some unintentional consequences. – ctrl-alt-delor Jun 29 '16 at 8:43

If you have access to at least one of the computers, you can monitor the traffic between the two.

You get wireshark and install it on one of the computers. It will be able to show you all traffic of that computer, including the one towards the 2nd (target) computer. You will be able to select the desired traffic by filtering based on the IP address of the 2nd computer.

  • How can I do that? – BurebistaRuler Jun 29 '16 at 8:34
  • I have updated the answer. – Overmind Jun 29 '16 at 8:38

You can add a third computer, though do not add it to the switch, as the switch will only send what is needed to each branch. Add it between one computer and the switch.

Using an old non-switching hub can be useful.

enter image description here

(as Hennes says, you can replace the switch and hub with a managed switch. However these are more expensive, and I am assuming that the switch already exists, and that you have no admin privileges to manage it. Another technique: if there is nothing else connected to the switch, then you can remove it)

A good bit of software is Wireshark.

As for permissions: The capture program dumpcap (part of wireshark) needs cap_net_admin, cap_net_raw (if your os uses the linux kernel), not full admin/root privileges.

  • 1
    A little addition: Instead of using a whole computer as a Hub you can also do this with a managed switch. See port mirroring and similar terms. – Hennes Jun 29 '16 at 8:49
  • I am not suggesting using a computer as a hub, though you could. The diagram has a hub as a hub. You are correct that if your switch is managed, then you may be able to configure it to do the hub bit as well. However if you can not get admin privileges this this can not be done. The cheapest is to put the monitor on A or B, but this need some admin rights when installing (not just because of the package manager, but because the tool needs elevated privileges). Also I have seen where there is a firewall on the machine with the monitor, I have got confusing results. – ctrl-alt-delor Jun 29 '16 at 9:57
  • @richard I use a Mac for this job – BurebistaRuler Jun 29 '16 at 10:14
  • Sniff, sniff sniff... Today you start to sniff and tomorrow and you will finish to be the old men in the middle. (@Hennes maybe I didn't really mean so old man in the middle :) ). – Hastur Jun 29 '16 at 12:45
  • Hastur hastur hastur – Hennes Jun 29 '16 at 13:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.