Monitoring traffic
To see what the user is doing, you can open Wireshark on Kali and select the eth0 interface to see all the traffic going over the network. To see only the traffic originating from the Windows machine, you can set a filter in the filter menu. Use the following filter:
ip.src == 192.168.74.129
This will only display the traffic that originates from the Windows machine. Now, if you were to go to the Windows machine and access a website, you should see the packet arriving in Wireshark:
Figure 5.13 – Wireshark traffic from a Windows machine
In this section, we learned how to poison an ARP table and monitor the network traffic between the victim device and the internet. In the next section, we will learn how this network traffic is encrypted and how this encryption can be broken.
