How to Capture Remote System Network Traffic

How to Capture Remote System network traffic?

You are connected to a switch which is "switching" traffic. It bases the traffic you see on your mac address. It will NOT send you traffic that is not destined to your mac address. If you want to monitor all the traffic you need to configure your switch to use a "port mirror" and plug your sniffer into that port. There is no software that you can install on your machine that will circumvent the way network switching works.

http://en.wikipedia.org/wiki/Port_mirroring

How to capture live traffic on a remote Linux server and how to view it in Wireshark on the local Windows machine?

You should use the tool rpcapd in the machine (A) that you want to capture the traffic:

rpcapd -n -p <port>

With -n is launched without authentication

Finally, in the other machine (B) go to Wireshark > Capture > Interfaces > Options > Manage Interfaces > Remote Interfaces

And you should see the traffic of Machine (A)

Getting Fiddler to capture remote traffic

The answer accepted by the OP involves installing Fiddler at the server, checking the Allow remote computers to connect in options and setting the proxy at the client that points to the server on the port Fiddler is exposed.

They have some screenshots of this setup here.

How to capture network traffic by process name in mac?

You can use lsof command, but it's more complex than netstat.

Here is a guide: lsof survival guide

Is it possible to see TCP traffic between two remote hosts in wireshark?

Not when between you and these hosts there is a SWITCH (as opposed to a HUB). A switch will only forward packets to the port on which the destination host is attached, whereas a hub propagates all packets it sees to all ports.

What you want can be achieved by (temporarily) installing a hub on which your computer and the two systems that need to be sniffed are connected.

EDIT: as MattH said in a comment, on many higher end switches there's a mirroring feature that allows you to use 1 port of the switch to sniff on another port. You could ask your network guy if your switch has such a feature, and get access to that feature for debugging purposes.

Sniff traffic with wireshark in wireless network

If you are using standard HTTP for your communication Charles Proxy is pretty much the standard for inspecting traffic from mobile devices to servers. You run Charles on your computer and point your phone to use your computer as a proxy server on port 8888 (the default) and you should be good to go.

http://www.charlesproxy.com/

If you are using your own packet protocol you should and need to use WireShark to inspect traffic see this part of the documentation about OSX setup.

http://wiki.wireshark.org/CaptureSetup/WLAN#Mac_OS_X

---

Related Topics