How to Capture Remote System network traffic?

Question

I have been using wire-shark to analyse the packets of socket programs, Now i want to see the traffic of other hosts traffic, as i found that i need to use monitor mode that is only supported in Linux platform, so i tried but i couldn't capture any packets that is transferred in my network, listing as 0 packets captured.

Scenario:

I'm having a network consisting of 50+ hosts (all are powered by windows Except mine), my IP address is 192.168.1.10, when i initiate a communication between any 192.168.1.xx it showing the captured traffic. But my requirement is to monitor the traffic of 192.168.1.21 b/w 192.168.1.22 from my host i,e. from 192.168.1.10.

1: is it possible to capture the traffic as i mentioned?

2: If it is possible then is wire-shark is right tool for it (or should i have to use differnt one)?

3: if it is not possible, then why?

Answer 1

You are connected to a switch which is "switching" traffic. It bases the traffic you see on your mac address. It will NOT send you traffic that is not destined to your mac address. If you want to monitor all the traffic you need to configure your switch to use a "port mirror" and plug your sniffer into that port. There is no software that you can install on your machine that will circumvent the way network switching works.

http://en.wikipedia.org/wiki/Port_mirroring

Answer 2

Just adapt this a bit with your own filters and ips : (on local host)

ssh -l root <REMOTE HOST> tshark -w - not tcp port 22 | wireshark -k -i -

or using bash :

wireshark -k -i <(ssh -l root <REMOTE HOST> tshark -w - not tcp port 22)

You can use tcpdump instead of tshark if needed :

ssh -l root <REMOTE HOST> tcpdump -U -s0 -w - -i eth0 'port 22' |
     wireshark -k -i -