0

First of all, to avoid the X/Y problem, here's what I'm trying to achieve: I want to monitor Computer B's raw network traffic from Computer A using Wireshark (more specifically npcap).

This is possible if the "Remote" machine is a actually local VM, because VMware will create virtual network adapters for the virtual machines, and those can be easily sniffed from Wireshark, just like the real interfaces.

I was hoping that a similar custom "Virtual Gateway" could be created, or one of VMware's existing ones could be reused, so that the second computer could connect to it, and I could analyze the network traffic with Wireshark. So my question is, is there a software that can create a virtual network gateway that other computers can connect to, to allow remote packet sniffing with npcap (Wireshark), or can I use one of VMware's existing adapters to achieve this.

Both computers run Windows.

1 Answer 1

2

You didn't mention an OS, just a "computer", but you did mention libpcap rather than Npcap or WinPcap, so I'm going to assume it runs or is able to run Linux or BSD.

Linux itself will act as a gateway without any additional software, and is indeed used for building real routers/gateways in many networks. If you already have two network interfaces on different subnets, all you need is to enable IP forwarding in the kernel using sysctl:

sysctl net.{ipv4,ipv6}.conf.all.forwarding=1

Hosts on one interface can now use you as a gateway to reach other interfaces, or whatever else you have in your routing table.

(If you want NAT, that's done through nftables or iptables – it's not part of IP forwarding. Make sure *tables doesn't have rules to drop all forwarded traffic.)

Though you don't need an L3 gateway here – it would likely be simpler to use the host as a L2 bridge (with both network interfaces then belonging to the same subnet), and monitor packets going through the bridge in 'promisc' mode while requiring no changes to the other host's configuration:

ip link add br0 type bridge; ip link set br0 up
ip link set eth0 master br0; ip link set eth1 master br0

Most BSDs similarly have full support for IP forwarding and L2 bridging in the kernel, though the commands are of course very different.

Windows used to have support for IP routing; in "consumer" versions it was found as the non-configurable "Internet Connection Sharing" feature. I don't know if it still exists in Windows 10/11. There are probably other threads explaining how to enable it.

Windows does have built-in support for Ethernet bridging – you can still create a bridge through ncpa.cpl by selecting two or more Ethernet (not Wi-Fi) interfaces.

1
  • I added a tag specifying Windows. Also, I was unaware that there are different types of the pcap library. So in my case, it would be npcap. I'll edit my question Mar 8, 2022 at 20:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .