Wireshark · Wireshark-users: Re: [Wireshark-users] Capture Filter

[Guy Harris <guy@xxxxxxxxxxxx>]

On Oct 14, 2008, at 7:33 PM, Michael Condon wrote:

> But at some point the traffic is not on their private switched  
> network - it
> is sending/receiving IP packets from various addresses on the  
> internet. This
> may be a DAQ (Dumb Ass Question), but isn't this traffic open to  
> capture?

If you can get access to one of the network hops between the sending/ 
receiving host and the destination host, yes, otherwise no.

Presumably one of the ports on the switch into which that host is  
plugged also has the next hop on that route plugged into it.  If that  
host and the hop after that are plugged into another switch or a hub  
that you *can* tap, as is the next hop on that route, or if the hop  
after that is a point-to-point link that you can tap, then you could  
capture that traffic.

Later, rinse, and repeat until you reach the final machine.