1

ok so here's the scenario:

Computer A captures some packets and saves the session into file 'traffic'.

Later on, Computer B opens the 'traffic' file and wants to know who captured the file...the ip of the pc that captured the packets.

how can this be achieved?

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Feb 19 '18 at 16:56
2

This can only be guessed by the received packets. If the capture used promiscuous mode (likely) and all segment packets were captured through a mirror port (possible), there's no way to find that out.

Without the mirror port, only unicasts intended for the capture machine and broadcasts should have been received (fully-switched network assumed). Therefore, only a certain destination MAC should show up with the local destination IP address(es).

0

If you are capturing unicast packets on computer A, it will include the IP address of computer A.

This link explains the different modes when capturing wireless traffic:

https://wiki.wireshark.org/CaptureSetup/WLAN

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.