This thread is to continue my previous one, where I was talking about the TCPDump command.
There is still something I don't get. According to this website (and some others), and according to my tests, one of the goals of TCPDump is exactly to intercept and display the communications of another user or computer. So basically it can sniff everything on the network, and when data are not encrypted we should be able to read them.
Please tell me if I am right about the following:
Let's talk about a wireless network where devices A, B, and C are connected to a WiFi access point. A, B, and C are all on the same network, let say 10.11.204.__ where A is 10, B is 20, and C is 30 for example.
Situation 1) In normal times if A wants to communicate with B, it will send out a packet with the IP Address of B in the header. So if the third device, C, is on the same network it will receive the packet addressed to B, but will see that the IP address is different that its own and will drop the packet.
Situation 2) When using TCPDump in the exact same situation (A sends a packet to B, with B IP in the header), C will receive the packet and will see that it is not addressed to him but will not drop it. And we will be able to read any part of the packet that is not encrypted. (So usually it is only the header).
Does it work like that? If it does, I don't understand why I can not read packets on my computer when I surf the web with my iPhone. I have also some issues with certain Android devices, for these devices I can only read "Echo" requests and "Echo" responses.
It is blurred in my mind, I like networking and I would like to understand that point. Thank you.