1

I need to determine the number of hosts on my network using wireshark. From what I have gathered, this is impossible on a Windows machine. Is this the case?

This is for school, so I simply need to know if this is possible on a Windows machine. I believe my professor may have made a mistake.

7
  • I'm confused. Do you want to know the number of hosts on the network, are do you want to know the number of hosts on the network which are using using Wireshark? The headline and the first sentence are very different.
    – Ron Maupin
    May 27 '16 at 0:54
  • I.e., do you mean "how many of the hosts on my network are using Wireshark?" or "how do I use wireshark to determine how many hosts there are on my network?"
    – user2373
    May 27 '16 at 5:56
  • I think that latter where punctiation was missing. "... network, using wireshark."
    – Max
    May 27 '16 at 12:20
  • I think you might be asking "How many hosts are connecting to the same wireless access point as me?", which is typically very different than "how many total hosts, including the ones on the wireless access point that I'm connecting to, hosts connected to other wireless access points, and hosts that use wired connections, are on the network?" Can you clarify which you mean, or are you asking something else? May 27 '16 at 15:30
  • I am asking about determining the number of hosts on the network, period. I need to use wireshark to accomplish this. Sorry for the ambiguity! May 27 '16 at 16:04
1

Capturing WLAN traffic on Windows depends on WinPcap and on the underlying network adapters and drivers. Promiscuous mode (mode in which you can see other machine's traffic) can be set; unfortunately, it's often crippled. In this mode many drivers don't supply packets at all, or don't supply packets sent by the host.

Even if promiscuous mode works with your WiFi adapter and drivers, you can only do that on an unprotected network. On a "protected" network, packets from or to other hosts will not be able to be decrypted by the adapter, and will not be captured, so that promiscuous mode works the same as non-promiscuous mode.

1

You can capture wireless packets and identify the unique MAC addresses using Wireshark with your adapter in promiscuous mode. Of course, this assumes all the hosts are talking while you are capturing packets. Even if you can't decrypt the packets, you will still see MAC addresses.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.