Is there any way (directly from a computer or device) to see the packets that pass the router from the different devices. Thanks.

closed as off-topic by Xander, dr jimbob, TildalWave, Iszi, Gilles Jan 15 '14 at 19:15

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions about general computing hardware and software are off-topic here, but can be asked on Super User." – Xander, dr jimbob, TildalWave
If this question can be reworded to fit the rules in the help center, please edit the question.

  • Which router? Yes, you can usually do something, but it is different if you're working with a high end Cisco, or a bargain basement 10 year old D-Link – Mark C. Wallace Jan 15 '14 at 16:39

Look at wireshark with an card on the network listening in promiscuous mode. Additionally, some routers will have a feature to log/see traffic going through directly; most home routers will not.


Yes, that is called "traffic monitoring" and there are many tools for doing it (for instance, wireshark is an excellent OSS package for that).

In many case, unless you can run the monitoring software directly on your router or on the target device though, you will need to use some special tricks in order to make sure the packets you want to capture will reach the interface that you use for monitoring. Depending on your specific needs and capabilities, it can be poisoning the ARP cache of the switch in between the devices, acessing the switch monitoring port, replacing the switch by a hub, using a special Ethernet "passive tap" cable (in the "cheap, DIY, I don't actually need CAT5/gigabit" way) or even using a link aggregation tap from a major vendor (in the serious business category).

  • To the best of my knowledge, Wireshark runs on a client machine on the network, which means it can't see the traffic goes through the ROUTER itself, just what's on the network that the client machine can see. How is it that you use Wireshark to see the traffic actually on the router? I'd be interested in a POC on that. – GµårÐïåñ Jan 15 '14 at 17:56
  • Please read the second paragraph of my answer: it deals exactly with that. – Stephane Jan 16 '14 at 11:13
  • I read it, doesn't "exactly" deal with that, hence why I asked if you actually had an implementation to share. The example you have given is more of a commercial routers like Cisco and HP that would be subject to this trick, certainly not Wireshark-able. Poisoning the ARP is more of a hack attack, to use it for monitoring will yield very unreliable results. Now passive TAP might work but still you are introducing another traffic channel that will result in data captured being less than pure. Question was can you monitor AS-IS or not, hacking it always a given, but organic observation is key. – GµårÐïåñ Jan 16 '14 at 19:00

Yes, but it depends on the router.

On a business-grade router that supports it, you can create a mirrored port, which replicates all traffic from a selected port. The mirrored port is then connected to something that can capture the traffic.

Certain types of specialized network security equipment (e.g. a Fortigate device), which are essentially routers with extra features, have packet inspection and logging built-in. You only need to supply a storage mechanism of some sort (e.g. SQL-compatible DB server).

If you're using a consumer grade router, you may be able to use alternative firmware to enable port mirroring. This is an example using iptables, available in some builds of Tomato firmware.

In effect what I wanted to do is set up a SPAN port in the Tomoto wifi world. Here's how I did it:

Enable the ipt_ROUTE module - if this doesn't work upgrade your firmware to something more recent.

/sbin/modprobe ipt_ROUTE

Replace iptomirror with the IP of the iPhone/wifi device you wish to listen to. Replace iptosendto with the IP of the computer running tcpdump/Wireshark.

iptables -A PREROUTING -t mangle -d iptomirror -j ROUTE --gw iptosendto --tee

iptables -A PREROUTING -t mangle -s iptomirror -j ROUTE --gw iptosendto --tee

iptables -A POSTROUTING -t mangle -d iptomirror -j ROUTE --gw iptosendto --tee

iptables -A POSTROUTING -t mangle -s iptomirror -j ROUTE --gw iptosendto --tee

The above 4 commands leverage the --tee option provided by the ipt_ROUTE kernel module and will:

  • Find any packet with source/destination IP of iptomirror, then
  • Duplicate both of these classes of packets packet and send a copy to iptosendto

These commands should do the trick to sniff traffic not just for iPhones, but for any device on connected to a Tomato router (and possibly DD-WRT, but I haven't tried). If you're having problems double check the ipt_ROUTE module is loaded: lsmod | grep ipt

And check your rules made it into the mangle tables:

iptables -L -t mangle

Not the answer you're looking for? Browse other questions tagged or ask your own question.