ARP Poison Routing: Wireshark Without a Monitor Port

It is 11:00 pm and the network is not working. You need to get a copy of Wireshark somewhere useful without digging through network closets for the monitor port on the master switch. But you are too tired, or maybe too lazy, to go locate and configure one.

Sound familiar? There is a clever trick to see everything without a monitor port on the router. Ettercap is a tool that allows for ARP Poison Routing, or APR. APR convinces the network that you are the gateway and, at the same time, convinces the gateway that you are the network.

This works by sending carefully crafted ARP replies that overwrite the ARP caches, the tables that translate between IP and MAC addresses, of every node in scope. Once the process completes, all network traffic flows through the poisoning device, which can be running Wireshark or any other tool that inspects local network traffic.

Before you start: the important caveats

The best part is that when you are done, the setup disappears in seconds without a trace. But there are two things to understand before you run this on a live network.

First, while the tool is running, SSL certificates will not validate on or from the targeted devices. Make sure every end user in scope is home for the night, and that nothing mission-critical on the network depends on an https connection during your window.

Second, this is a technique for a network you own and administer. ARP poisoning on a network you do not control is a different matter entirely. Treat this as a troubleshooting tool for your own environment, used with the knowledge of whoever owns that environment.

With that understood, here is an easy-to-follow guide to getting a man-in-the-middle position on your own network traffic without setting up a monitor port on the master switch.

The step-by-step

1. Install Ettercap and dependencies, if needed. On a Debian-based system: sudo apt-get install debhelper cmake bison flex libgtk2.0-dev libltdl3-dev libncurses-dev libncurses5-dev libnet1-dev libpcap-dev libpcre3-dev libssl-dev libcurl4-openssl-dev ghostscript ettercap-gtk, or the equivalent for your platform.
2. Open Ettercap in graphical mode with the command ettercap -G, or select it from your applications list.
3. Enable network sniffing and bind Ettercap to an interface. In the top menu, select Sniff, then Unified sniffing.
4. Choose the interface to sniff on. For wireless the name usually starts with wlan, and yes, wireless sniffing does work. For ethernet it usually starts with eth.
5. In the menu, select Hosts, then Scan for hosts.
6. Open the host list with Hosts, then Hosts list.
7. Select every device whose traffic you want to see, then press Add to Target 1 to tell Ettercap these are the devices to poison.
8. Load the plugins you need. Select Plugins, then Manage the plugins.
9. Double-click the plugins named autoadd and repoison_arp. These keep the targeted devices sending their traffic to you until you end the session.
10. Start the attack. From the menu, select Mitm, then ARP poisoning.
11. Enable Sniff remote connections and press OK.
12. Use your newly created monitor port for whatever you need, such as Wireshark.

When this is the right tool

This is a simple solution for the moment you either do not have a monitor port or cannot get to one. It is fast to set up, fast to tear down, and leaves nothing behind. It is not a replacement for a properly configured span port in a monitored production environment, but for late-night troubleshooting on a network you administer, it can turn a two-hour closet expedition into a five-minute fix.