I would like to try to sniff a typical CWMP conversation that my router does to his Auto Configuration Server (see TR-069 crash course: https://www.iol.unh.edu/sites/default/files/knowledgebase/hnc/TR-069_Crash_Course.pdf)

I know the server URL and the fact that it uses a self-signed certificate so I suppose that a MITM with a passive client could be tried.

The goal is to obtain the Voip credentials associated to MY ACCOUNT since my provider does not give them to me.

My hardware is a dual ethernet linux box.

My ideas are:

  • Use EBTABLES to manipulate layer 2 traffic and pass all the IN or OUT traffic on given ports and with source/destination IP of the ACS to iptables
  • Use IPTABLES to redirect traffic to a MITM SSL proxy and try to see the conversation in cleartext.


  • Every example that I find is for a switched network with some sort of NAT/Arp spoofing etc. etc. I just have 2 IP and I learn one of them after PPPoE.
  • I want to intercept some kind of traffic and redirect it to my proxy, all other traffic shuld be untouched

A first POC would be to intercept traffic, mark it and log it in iptables anche forward it without notice by client/server, but I still can't figure out how to do it.

Thanks for any help.

  • you can do all on your linux box - use sslsplit to intercept the encryption - nat the traffic to with iptables - use sslsplit-nat to set original destination adress – spitzbuaamy Jan 31 '17 at 11:30
  • thanks, the actual problem is to let the traffic pass to the layer 3 analysis. Can't to figure out how, i've already tried ebtables -t broute -A BROUTING -p ipv4 -j DROP iptables -t nat -A PREROUTING -p tcp --dport XXX-j REDIRECT --to-ports XXXX but it does not work. Probabily I have to change Destination MAC of the packets incoming from both bridge interfaces to actual brigde MAC and then change it back to origina ldestination mac – mleone87 Feb 1 '17 at 8:37

If passive MITM is sufficient you don't need to reroute anything. What you are looking for is a so called "lan tap". There are plenty of hardware tools on the market but you will be able to construct one yourself quite easily. It only consists of several ethernet ports and maybe some capacitors. You will only need those in case you want to sniff a 1G line with a 100M ethernet port.

There is a lan tap on the market by Michael Ossmann here which I recommend looking at because he seems to be a great guy with lots of nice ideas.

Anyways you can easily build one yourself like e.g. in this tutorial. You can then put it between the WAN side and your uplink and happy sniffing ;)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.