Introduction to packet capturing – the right places to look
There are multiple ways to intercept and capture packets between two hosts, and multiple places in the communications path to do it from. Let's discuss some of the more popular choices.
Capturing from either end
This is definitely the easiest option since when all is well, the hosts at both ends of the conversation will receive or send all packets. There are a few detractors to this, though:
- You may not have access to either end. Depending on the situation, one of the endpoint hosts may not be in your organization at all.
- Even if they do, you may not have administrative access to the host (or hosts) in your environment. Especially in a corporate environment, it's common to see that the networking team and/or security team may not have administrative access (or any access) on servers especially.
- Installing new system software is not usually something you can do willy-nilly in most organizations...