Is there any way (directly from a computer or device) to see the packets that pass the router from the different devices. Thanks.
closed as off-topic by Xander, dr jimbob, TildalWave, Iszi, Gilles Jan 15 '14 at 19:15
This question appears to be off-topic. The users who voted to close gave this specific reason:
- "Questions about general computing hardware and software are off-topic here, but can be asked on Super User." – Xander, dr jimbob, TildalWave
Look at wireshark with an card on the network listening in promiscuous mode. Additionally, some routers will have a feature to log/see traffic going through directly; most home routers will not.
Yes, that is called "traffic monitoring" and there are many tools for doing it (for instance, wireshark is an excellent OSS package for that).
In many case, unless you can run the monitoring software directly on your router or on the target device though, you will need to use some special tricks in order to make sure the packets you want to capture will reach the interface that you use for monitoring. Depending on your specific needs and capabilities, it can be poisoning the ARP cache of the switch in between the devices, acessing the switch monitoring port, replacing the switch by a hub, using a special Ethernet "passive tap" cable (in the "cheap, DIY, I don't actually need CAT5/gigabit" way) or even using a link aggregation tap from a major vendor (in the serious business category).
Yes, but it depends on the router.
On a business-grade router that supports it, you can create a mirrored port, which replicates all traffic from a selected port. The mirrored port is then connected to something that can capture the traffic.
Certain types of specialized network security equipment (e.g. a Fortigate device), which are essentially routers with extra features, have packet inspection and logging built-in. You only need to supply a storage mechanism of some sort (e.g. SQL-compatible DB server).
If you're using a consumer grade router, you may be able to use alternative firmware to enable port mirroring. This is an example using iptables, available in some builds of Tomato firmware.
In effect what I wanted to do is set up a SPAN port in the Tomoto wifi world. Here's how I did it:
Enable the ipt_ROUTE module - if this doesn't work upgrade your firmware to something more recent.
Replace iptomirror with the IP of the iPhone/wifi device you wish to listen to. Replace iptosendto with the IP of the computer running tcpdump/Wireshark.
iptables -A PREROUTING -t mangle -d iptomirror -j ROUTE --gw iptosendto --tee
iptables -A PREROUTING -t mangle -s iptomirror -j ROUTE --gw iptosendto --tee
iptables -A POSTROUTING -t mangle -d iptomirror -j ROUTE --gw iptosendto --tee
iptables -A POSTROUTING -t mangle -s iptomirror -j ROUTE --gw iptosendto --tee
The above 4 commands leverage the --tee option provided by the ipt_ROUTE kernel module and will:
- Find any packet with source/destination IP of iptomirror, then
- Duplicate both of these classes of packets packet and send a copy to iptosendto
These commands should do the trick to sniff traffic not just for iPhones, but for any device on connected to a Tomato router (and possibly DD-WRT, but I haven't tried). If you're having problems double check the ipt_ROUTE module is loaded:
lsmod | grep ipt
And check your rules made it into the mangle tables:
iptables -L -t mangle