Destination IP address is very useful, though. Without being able to decrypt encrypted application layer protocols, that may be the most that I can get out of this technique for detecting malware. I could see IP layer transactions to see the destination IP addresses, and HTTP (non-HTTPS) showed me actual HTTP data. Once in the data capture view the useful information was the IP and HTTP (application) layers. This started real-time network monitoring. Once in Wireshark I selected the network interface associated with the other computer. When installing Wireshark, I selected all additional packages such as WinPCap. This sets up an additional DHCP server to address the other computer.

Instead, I used Internet Connection Sharing in Windows 10. DHCP from the 'Ethernet port 2' side (outside the Wireshark laptop) addressed both the Wireshark laptop and the other computer, but network transactions from either computer wouldn't work. I tried Bridge Connections but it didn't work. I used a crossover CAT6 cable from the other computer to the Wireshark laptop. Basically I want to build a device to wiretap myself.Ĭould you please tell me how to set up the network adapter software to 'bridge' Ethernet port 1 to Ethernet port 2 so that data is bidirectionally passed through the 2 Ethernet ports? In addition Wireshark needs to be able to sniff from either of these Ethernet ports. If you install Wireshark locally, viruses have enough kernel access that they can prevent Wireshark from 'seeing' the outbound network data they send, so you must use an external sniffer. This will allow me to capture malicious outbound data. I will run Cat 5 from the other computers into Ethernet port 1 of the Wireshark laptop, and more Cat 5 from Ethernet port 2 of the Wireshark laptop to the Internet connection. This can be Windows 10 configuration, or require installing commercial software. Someone will hopefully tell us how to set up the network adapter software to 'bridge' Ethernet port 1 to Ethernet port 2 so that data is bidirectionally passed through the 2 Ethernet ports.

Now the Wireshark laptop has two Ethernet ports. I will install a USB Ethernet dongle to the Wireshark laptop.

I would like to do the following scenario:Ī laptop running Windows 10 with 1 Ethernet port.

Wireshark windows