I have a cisco epc3825 cablemodem that provides internet to a number of PC's via Wifi. I'd like to add Linux PC on the LAN to monitor traffic usage on all PC's on the same LAN. Is this possible? Would this require some sort of man-in-the-middle -scheme to work?


Yes, this is possible and rather easy to set up. If you have access to the LAN, you can use a passive sniffer such as Wireshark or tcpdump to monitor all of the traffic on the network. There are tons of tutorials online for how to set up Wireshark to capture network traffic. Here is a link to the official documentation: Wireshark User's Guide.

However, for any traffic that is encrypted (with SSL/TLS, SSH, etc) you will be able to capture the packets, but won't be able to read the data. In that case, you would have to resort to some sort of MITM attack using a tool like sslsniff/sslstrip. For an explanation of how this works, check out this video: Defeating SSL using sslstrip.

  • Traffic is not encrypted and Wireshark is a bit of overkill. Let say the linux pc is on and I want to see "sniff" traffic to another pc that has IP How would tcdump do that? – user1231247 Apr 2 '18 at 12:23
  • Not sure what you mean by "overkill" ... it does exactly what you asked. But if you want something more lightweight, then use tcpdump, as I also suggested. – J. Taylor Apr 2 '18 at 12:25
  • As far as the answer to you updated comment, asking about how to use tcpdump: see the tcpdump man page. To intercept all packets from host, use tcpdump -n host – J. Taylor Apr 2 '18 at 13:07
  • Although unless you have some good reason not to use Wireshark, or want to be writing a bunch of scripts to process the data, I'd really recommend doing that instead. Wireshark has a bunch of utilities for filtering and processing the data, to make it more readable for you. – J. Taylor Apr 2 '18 at 13:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.