How can I see traffic between two devices on the same network

edit

Thanks

I have followed some guides on MITMf and wifi monitor mode and so on from an ethical hacking point of view. I will mess about later with the wifi side of it.

Specifically I want to show someone how to see a DDoS attack in progress or how to analyse and identify one.

If using Ethernet and the attack comes from outside my network will the traffic show? If a device on my network is DoS ing another device, how can I evidence that?

Stu

As per the Wiki page, when on an Ethernet switched network you will only see traffic directly to or from the capturing host, along with any broadcast messages.

If an attack comes from outside your network, then your router will block this unless you have configured port-forwarding to send the traffic to an internal host. To see non-port-forwarded traffic you would need to capture on the router. Some routers (not most SOHO ones) can capture traffic, some can be uploaded with modified firmware, e.g. OpenWRT, to allow capture on the router.

If the attack is generated by an internal host (to the outside), then again you would either need to capture on that host or the router. Another host on a different router switch port will not see the traffic.