We have an internet connection that we need to audit:


our idea would be to put a (enough big) HUB before the router (router, that logs in via pppoe to the ISP) and on that HUB put an OpenBSD* machine too:


*I want to run a:

tcpdump -i em0 -w out.pcap

on the OpenBSD machine (em0 is the interface plugged in to the HUB, -no IP address needed for that interface?). I choosed OpenBSD since it has a history regarding security, so if there is an attacker, it wont go in via tcpdump, since tcpdump could have vulnerabilities, and it listens on the interface.

My question: is this the perfect solution? (no, I don't trust proprietary HW that can do "port mirroring")

UPDATE: We don't want to put an iptables rule in the router to send all traffic to a logserver.


In theory your solution should work just fine at a basic level with a caveat. You'll need to find a hub that works at the speed of your Internet connection or greater. Depending on the speed of your Internet connection that might be tricky, especially has hubs are getting harder to find.

I guess a question is why you don't trust dedicated port mirroring hardware, as that would be the standard way of doing this. Either setting a port on a switch to be mirrored, or using a network tap

  • Most managed network switches have port mirroring (sometimes called something else) that sends a copy of all traffic sent or received on select other port(s) to the mirror port.
    – Brian
    Feb 4 '14 at 10:43
  • Something else -> spanport Feb 8 '14 at 9:35

It’ll work, but it might not be the perfect solution—if you’re doing PPPoE, everything you capture is going to be encapsulated and, depending on how much traffic you have, that tcpdump file could become quite large and unwieldy quickly. What are you trying to audit exactly? Assuming the router is also running OpenBSD, a better solution would take advantage of pflow(4) in conjunction with pf(4) and combine that with the nfdump port. Also, for what it’s worth, there are no iptables on OpenBSD.


Do you really need copy all the traffic, or just logs the users navigation? The mostly of applications are now using SSL. So you can't see what they do in Facebook, Skype and so..

I think you need a application firewall. I recommend you read about UTM Firewalls.

But if you really want to copy the whole traffic, then use filters in tcpdump to "clear" your capture, like:

tcpdump -i em0 -s0 'not arp and not icmp and not port 443'

The -s option it's for tcpdump not truncate de packets. Some OS you'll have to use -s1512.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.