Sniff outside computer
For an assignment I need to analyze a compromised machine and I’m trying to sniff an outside machine. I was trying with wireshark by setting up a filter but I haven’t been able to. Is their another option to do this? Or is it not possible?
Posted Jul 24, 2021, 4:41 PM UTC
47
You can only capture traffic the system running the capture process actually sees, though there are ways to do that remotely and forward the captured traffic from a remote capturing system to a local system running Wireshark (though that doesn't sound like what you're trying to do).
If the capturing system is in the path of the traffic (e.g. it's a router or firewall) then things should be pretty simple, assuming it has capturing capability at all. If the capturing system is connected to a switch for the local LAN that's forwarding the traffic in question between other hosts/devices then that switch would have to support "port mirroring" so it could send a copy of the traffic in question to the physical port the capturing device is connected to, since switches don't normally forward traffic to ports other than the one the destination device is connected to. This will pretty much always require that switch to be of the "managed" variety rather than a cheap "dumb" switch. If you're trying to capture wireless traffic things get more complicated, since not all wireless interfaces support the necessary mode for capturing wireless traffic not to/from the local system.
If you could provide more details on what you mean by "sniff an outside machine" that would be useful for helping to identify if what you want to do is possible.
Hope this helps!
Awesome thanks so much for the explanation! And I wish I could provide more details but the profesor just left it to us as an “open lab”. So their is pretty much no instructions. So all we are told pretty much is this is the compromised machine don’t mess with it and if you can ping from another machine your on the right track.
The only guidance I got from the professor was people had success using network miner but from my understanding I would need to upload a pcap file to it. And wireshark is the only tool I know that I can use for it and well snort but have not been able to troubleshoot it all nor anyone I know.
If you have IP connectivity to the compromised host from a test host (i.e. you can ping it) then you could do all your packet capturing on that test host and that way see how the compromised host responds to various kinds of traffic. I don't know the topology of your "open lab" but if it didn't provide a managed switch you could use to mirror the bad host's Internet traffic you could maybe do some ARP poisoning to make your test host a Man in the Middle and grab all the bad host's traffic that way. In short, if you have the ability to reconfigure the network to which the bad host is connected then there are lots of things you can do to monitor and scan the bad host.
I know these kinds of vague assignments can seem frustrating, but the benefit is that they can better reflect the real world and help encourage you to be creative in your thinking and problem solving approach. I'd suggest not imposing any artificial constraints on yourself that aren't explicitly stated as part of the assignment, since that's an easy thing to do, even in the "real world", and can hinder your efforts.
Good luck!
Something new that I’m going to have to learn then thanks!