I am trying to capture some IP packets in my personal LAN with tcpdump, through the commandtcpdump -A -i eth0 'tcp and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0) and host 192.168.1.x'where 192.168.1.x is the target host in the network. But it works only if the target host is my ip, that is the IP of the machine where tcpdump runs. With any other IP in the network it doesn't record anything.I have an unmanaged switch. The simpler commandtcpdump -A 'host 192.168.1.x'detects only some igmp packets periodically sent to a broadcasting address, 224.0.0.251, from the host 192.168.1.x.But how could the IP capture be performed?Thank you anyway!
tcpdump command works only on local ip
networking;ip;tcpdump;hosts
That's probably because a switch only sends traffic down a port if it believes the destination MAC address is attached to that port.On a managed switch, you'd set up monitor mode.On an unmanaged switch, you're left with a couple of options:ARP spoofing, to trick the rest of the network about which MAC address corresponds to the target IP address. You then re-send the packets with the correct MAC address.Flooding the switch with enough MAC addresses that it gives up and forwards all packets to every port. May or may not work.Replacing the switch with either a hub (always forwards all packets to all ports, but also only half-duplex and a bunch of other disadvantages) or a managed switch. A unix box with sufficient ethernet ports can function as a managed switch.If you care about Internet traffic only, run tcpdump on the gateway.Install a network tap on the Ethernet cable going to the machine sending or receiving the traffic you want to monitorThe dsniff tools arpspoof and macof implement the first two.(These may also bring down your network, and require you to reboot various bits of network gear. Since its your own network, that's your business; doing it on anyone else's networkat least without their permissionwould be considered anything from extremely impolite to downright illegal.)