Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I am trying to capture some IP packets in my personal LAN with tcpdump, through the command

tcpdump -A -i eth0 'tcp and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0) and host 192.168.1.x'

where 192.168.1.x is the target host in the network. But it works only if the target host is my ip, that is the IP of the machine where tcpdump runs. With any other IP in the network it doesn't record anything.

I have an unmanaged switch. The simpler command

tcpdump -A 'host 192.168.1.x'

detects only some igmp packets periodically sent to a broadcasting address, 224.0.0.251, from the host 192.168.1.x.

But how could the IP capture be performed?

Thank you anyway!

share|improve this question

1 Answer 1

up vote 6 down vote accepted

That's probably because a switch only sends traffic down a port if it believes the destination MAC address is attached to that port.

On a managed switch, you'd set up monitor mode.

On an unmanaged switch, you're left with a couple of options:

  • ARP spoofing, to trick the rest of the network about which MAC address corresponds to the target IP address. You then re-send the packets with the correct MAC address.
  • Flooding the switch with enough MAC addresses that it gives up and forwards all packets to every port. May or may not work.
  • Replacing the switch with either a hub (always forwards all packets to all ports, but also only half-duplex and a bunch of other disadvantages) or a managed switch. A unix box with sufficient ethernet ports can function as a managed switch.
  • If you care about Internet traffic only, run tcpdump on the gateway.
  • Install a network tap on the Ethernet cable going to the machine sending or receiving the traffic you want to monitor

The dsniff tools arpspoof and macof implement the first two.

(These may also bring down your network, and require you to reboot various bits of network gear. Since its your own network, that's your business; doing it on anyone else's network—at least without their permission—would be considered anything from extremely impolite to downright illegal.)

share|improve this answer
    
There's a detailed discussion of much of this on the Ethernet capture setup page on the Wireshark Wiki. –  Guy Harris Apr 21 at 22:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.