Tapping into the stream

While tapping into a LAN with the Network Interface Card (NIC) in promiscuous mode, the adapter captures the traffic and sends the packets up through the Enhanced Packet Analyzer (EPAN) for dissection and decoding, and then on to the Wireshark interface.

You'll then see the packets filling the screen. If you are on an end device and communicating with another host, you will most likely see three types of packets – namely, broadcast, multicast, and unicast:

• Broadcast: Packets are sent from one host to everyone on a network – for example, an ARP broadcast.
• Multicast: Packets are sent from one host to many hosts – for example, using Enhanced Interior Gateway Routing Protocol (EIGRP) multicasts.
• Unicast: This sends packets from one host to another host– for example, from your computer to a web server.

In a normal conversation with another host, once you have a connection, the OS will create a socket, which...