How can I debug traffic on a switched network with Wireshark?

Question

I have an IP phone on my home network that I am trying to call using SIP from outside of my home network. I have port forwarding setup, but the phone is responding with a SIP 404 message. All the documentation I've seen says to look at the incoming traffic for this connection via Wireshark. How do I do this?

My computer and this phone are both plugged directly into the router. Is there any way I can listen to the traffic on my computer with the current setup? I'm not sure if 'switched network' is the correct term, but I remember that on older networks that used hubs instead of switches, all packets were broadcast to all devices and listening to traffic not meant for you was easier.

I appreciate the privacy that switching provides, but what about in this case where I need to do debugging and have control over the network? Do I need to connect both the computer and the phone to a hub and then connect that to my router so the traffic is broadcast to both of their network cards? I don't have a hub at the moment so I have not tried this yet.

What are the other ways to capture packets meant for other devices in this scenario?

Answer 1

Changing your hardware setup just for the purpose of resolving the IP Phone issue might be pointless because you would be diagnosing different network setup that you want or need.

I would suggest performing an ARP spoofing attack on your own network.

With huge simplification: ARP Spoofing attack will make your IP Phone think that your computer is in fact router. IP Phone will address all the packets with your computers MAC address instead of router MAC address. Router would forward all those packets to your computer where you can see them, readdress them correctly and forward back to the router.

There are easy to use tools for those kind of attacks. If you don't run linux, boot your computer from Kali Linux USB stick. It's loaded with penetration tools like that.

Answer 2

Monitoring Internet Traffic in Switched Networks

These days, the majority of local networks are switch-based. Unlike a hub, a switch, when it has received a packet from some port, retransmits it only to one port, where the recipient computer is connected to it. Switches maintain a table of MAC addresses and ports associated with each of those addresses (Content Addressable Memory table). When it has received a packet, switch validates the recipient’s MAC address in the table and selects the matching port to route the packet to. Due to this feature, Internet monitoring with LanDetective may be limited – your adapter will accept only packets that are addressed to you explicitly, because the switch would prevent other packets from getting into your network segment. Note that switches were created not for cutting traffic monitoring opportunities but rather for minimizing network load and maximizing its bandwidth. Moreover, there are special managed switches available on the market (and they are widely spread), which on top of their common features have a special one – to simplify the operation of traffic analysis systems and Internet monitoring solutions. Thanks to this capability, a managed switch can be configured in a way that all packets passing through it would be replicated to a certain switch port. Different manufacturers call the function a different name: Port Mirroring, Switched Port Analyzer (SPAN), or Roving Analysis Port (RAP). If you are a happy owner of a managed switch, turn to the specification for your device to find out whether this feature is supported and how you can activate it. In order to start Internet monitoring after the activation of Port Mirroring, you will need to just connect to the specified switch port and use the promiscuous Capture mode in LanDetective.

If you have linksys router then following way you can use Port Mirroring to get traffic on other switch interface. Linksys Router Port Mirrorning

• Dirty way to capture traffic

If your switch is unmanageable or you don't have access you can connect your IP Phone directly to your laptop/Desktop and use Wireless Interface of laptop to connect your wireless router, also you need to configure routing in laptop to pass IP phone traffic through laptop that way you can run wireshark on your laptop and capture packets.