16

AFAIK, the NIC receives all packets from the wire in a Local Area Network but rejects those packets which their destination address is not equal to its ip.

I want to develop an application that monitors the internet usage of users. Each user has a fixed IP address.

I and some other people are connected to a DES-108 8-Port Fast Ethernet Unmanaged Desktop Switch

As said earlier I want to capture all the traffics from all users not only those packets that are belong to me.

How should I force my NIC or other components to receive all of packets?

Improve this question
1
  • 1
    Buy a cheap and managed switch for about 30€ and enable port mirroring on the link to the gateway. Commented Apr 10, 2017 at 3:41

4 Answers 4

Reset to default
29

AFAIK, the NIC receives all packets from the wire in a Local Area Network but rejects those packets which their destination address is not equal to its ip.

Correction: it rejects those packets which their destination MAC address is not equal to its MAC address (or multicast or any additional addresses in its filter.

Packet capture utilities can trivially put the network device into promiscuous mode, which is to say that the above check is bypassed and the device accepts everything it receives. In fact, this is usually the default: with tcpdump, you have to specify the -p option in order to not do it.

The more important issue is whether the packets you are interested are even being carried down the wire to your sniffing port at all. Since you are using an unmanaged ethernet switch, they almost certainly are not. The switch is deciding to prune packets that don't belong to you from your port before your network device can hope to see them.

You need to connect to a specially configured mirroring or monitoring port on a managed ethernet switch in order to do this.

Improve this answer
4
  • 1
    Or an Ethernet hub... if you can find one rusting away in the attic :) I doubt there are any for 1000Base-T though, Wikipedia says gigabit hubs supported only half duplex links and they are deprecated now. Commented Apr 9, 2017 at 16:01
  • 1
    @chx, all true hubs only supported half duplex. Personally, I've never seen a 1000Base-T one. Commented Apr 9, 2017 at 18:12
  • I believe this had to do with the slow uptake of Gigabit Ethernet -- although the 802.3ab standard came out in 1999, uptake was very slow until 2003/2004 when Intel first released the 875P chipset with the dedicated CSA bus for Gigabit Ethernet and then in 2004 PCI Express took over with finally enough bandwidth for Gigabit Ethernet. And by then, switches were cheap enough. Commented Apr 9, 2017 at 21:42
  • Ethernet switch won't always broadcast the Frames. It has it's own switching table(contains map of switch port and MAC address) for unicasting the Frame. If the table doesn't have an entry for the MAC in the Frame, then it broadcasts/floods the frame. Your desktop will never receive other Frames. As in the answer, you have to use special switch for capture all the frames that arrives at your switch. Commented Apr 14, 2017 at 3:21
8

In the early says of ethernet hubs (not switches), sent packets are available to all hosts on the subnet, but hosts that are not the intended recipient are supposed to ignore.

Obviously, it didn't take long for subnets to saturate, so switch technology was born to solve the problems, and one of the things they did was make the network switch only route packets destined for that host to that port (plus andy broadcast traffic).

This complicates network monitoring/sniffing because you can only sniff packets that are for your host. This was considered a good thing from a security standpoint, but from a network monitoring standpoint not so good. To make network monitoring work, vendors implement a feature called port mirroring. This has to be configured on the network switch, and the below link should point you in the right direction for D-link products. You'll find it somewhere in your switches management software or web admin interface. If you don't find these features, then the functionality may not be provided in that specific device.

http://www.dlink.com/uk/en/support/faq/switches/layer-2-gigabit/dgs-series/es_dgs_1210_como_monitorear_trafico_de_un_puerto_port_mirroring

Improve this answer
2

First you need to switch your NIC to promiscuous mode. Let's assume that your NIC interface is eth0.

root@linux#ifconfig eth0 promesc

If you're on a switch network your sniffing is reduced to the collision domain connect to your switch port. You can run macof to overwhelm the forwarding table of the switch.

root@linux#macof -i eth0

Then you can use wireshark or tcpdump to capture all traffic.

root@linux#tcpdump -i eth0 -w outputfile

If you're not on a switched​ network, just enable the promiscuous mode and use tcpdump.

Improve this answer
1
  • 1
    tcpdump will enable promiscuous mode for you. You don't need to do it (and remember to undo it when you're done) manually. Commented Apr 9, 2017 at 18:14
0

You're reinventing the wheel.

Assuming you have a simple network with clients connecting to switches, with a default gateway to the internet, then you only need to monitor on that default gateway device. This will be a choke point to show all traffic between a LAN client and the internet.

I'm assuming LAN client to LAN client traffic is not of interest, because with all IP addresses inside the same IP subnet then local traffic doesn't touch the default gateway.

If you really do want to see all traffic, each user needs to be in their own IP network and traffic to the other networks is via the default gateway. You could allocate a /28 to each person and they can have 14 IPs to themselves.

Your average home-grade router won't handle much of this, you'll need to explore a dedicated firewall distro. Personally pfsense would be my go-to, but there are many options.

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.