That mode is called “Promiscuous Mode”, and Wireshark does it automatically by default:
Now, if you want to tell your network card “hey, accept everything! Forget the destination thing filtering, I want it all!” you need to enable a special mode on the network card. So if you want to grab stuff that others are sending to each other, you’ve got a problem. Take a good look at number 3 – this means that if your network card sees packets that are sent from other PCs to other servers (without your PC being involved at all), your card will not even really look at them except to find out that it doesn’t care.
if the destination address in the packet does not match the address of the network card the packets will simply be ignored and discarded. if the destination address is a match, the packets are destined for your PC and will be passed up to the CPU and processed. All the packets on the network that actually arrive at your PCs (or Mac) will be inspected to check if they have a destination that matches the network card. This may sound complicated, but it basically works like this: “Normal” user rights aren’t enough in most cases, because you need to enable Promiscuous Mode on the network card to be able to capture packets that are not meant to be received by your PC. Capturing network packets in general is easy – you can do it on almost any PC where you’ve got administrative rights. The first thing you need to do is to capture the network packets that contain the passwords (or other credential types, but let’s say we’re focusing on passwords for now). So there must be passwords or other authorization data being transported in those packets, and here’s how to get them. Wireshark is a great tool to capture network packets, and we all know that people use the network to login to websites like Facebook, Twitter or Amazon.
0 kommentar(er)
