Ask Your Question

How can I see traffic between two devices on the same network

asked 2017-11-22 15:50:31 +0000

Sophienna gravatar image


I have a home router - I have a windows tablet PC - I have another laptop - My main laptop with Wireshark is

Devices can either be WiFi or Ethernet but all are on the same network using the same router.

When I ping from to anything else or vice versa back to and use Wireshark I can see the traffic. Specifically I am constantly pinging or performing a 'ping of death' between devices. I can see the long list of pings, no problem.

However, if I ping between and, then use my Wireshark machine I cannot see any traffic between those two devices.

It seems I can only see this type of traffic when my Wireshark machine is some how involved of part of the ping process.



edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2017-11-22 15:58:48 +0000

grahamb gravatar image

See the Wiki pages on capturing setups, Ethernet and WiFi.

For Ethernet, your router acts as a switch so will only see packets to\from the capturing machine.

For WiFi, to see packets from other machines you need to put the interface into "Promiscuous" mode which is difficult\impossible with Windows, see this subsection of the WLAN page.

edit flag offensive delete link more



I have followed some guides on MITMf and wifi monitor mode and so on from an ethical hacking point of view. I will mess about later with the wifi side of it.

Specifically I want to show someone how to see a DDoS attack in progress or how to analyse and identify one.

If using Ethernet and the attack comes from outside my network will the traffic show? If a device on my network is DoS ing another device, how can I evidence that?


Sophienna gravatar imageSophienna ( 2017-11-22 16:53:27 +0000 )edit

As per the Wiki page, when on an Ethernet switched network you will only see traffic directly to or from the capturing host, along with any broadcast messages.

If an attack comes from outside your network, then your router will block this unless you have configured port-forwarding to send the traffic to an internal host. To see non-port-forwarded traffic you would need to capture on the router. Some routers (not most SOHO ones) can capture traffic, some can be uploaded with modified firmware, e.g. OpenWRT, to allow capture on the router.

If the attack is generated by an internal host (to the outside), then again you would either need to capture on that host or the router. Another host on a different router switch port will not see the traffic.

grahamb gravatar imagegrahamb ( 2017-11-22 18:30:37 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2017-11-22 15:50:31 +0000

Seen: 16,796 times

Last updated: Nov 22 '17