I am connected to my router and I want to know if it is a possibility to sniff a data from a router that is over my router?

  • Can you explain what you mean by "over" your router? Commented Jul 14, 2014 at 10:03
  • My router is connected to a router that is up it. I would not want to do sniff at my router I want to sniff at the router up.This router up have my router connected to it and other devices..
    – user50189
    Commented Jul 14, 2014 at 10:18
  • Ah. That is usually called the "upstream" router. Since you don't want to listen at your router, does that mean you want to see traffic that is going to the other devices? Also, are you the owner/administrator of the upstream router? Commented Jul 14, 2014 at 13:10
  • Sorry Graham Hill for my expression but I didnt know how to say.Yes,thats the problem = upstream router .I`m not the administrator of the upstream router
    – user50189
    Commented Jul 14, 2014 at 14:20

3 Answers 3


You cannot passively sniff packets that aren't passing through the part of the network you control, no.

However, attackers sometimes use a related kind of attack, where they compromise either the router or the hosts in the target network to make them send packets where they shouldn't. Then they can be passively sniffed.

  • Sounds like a redirect traffic,you have any ideea what to know to start ?
    – user50189
    Commented Jul 15, 2014 at 12:33
  • 1
    Not without upsetting my delicate dance around "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." Commented Jul 16, 2014 at 9:55

How to sniff data from an upstream router?

It is a bit like tracking the comings and goings of your neighbours and their guests on the first floor, while you live in an apartment on the second floor.

Technically you cannot. No way. Nada. This problem, as it stands, is unsolvable. No solutions.

But maybe you can change the problem a little bit?

  • convince the router to echo traffic towards your host ("virtual promiscuous interface", "remote packet inspection" and so on). It is the equivalent of bribing the apartment block's doorkeeper so that he phones you as soon as someone enters the door at ground level. Since routers can't easily be bribed, you need an administrator access on the router.

  • confuse matters and make the relevant host(s) believe that whoever they seek on the upstream router is actually you. This is the equivalent of exchanging the DNS name tags on the door bell so that your neighbours' guests sound your door. Then you have to reroute the packets on the correct route and hope nobody smells anything fishy. It helps if you have to deal with terminal alcoholics.

  • maybe you aren't interested in the exact details but in some other rough measure ("they're partying again!"). In that case it is often the case that whatever happens upstream can be gleaned or guesstimated downstream; average packet delay may vary, some forged MAC queries evoke different responses, and so on. You could call the lift every five minutes, when it doesn't answer it means someone is using it; it's not a guest of yours, so it's your neighbours'. Similarly, not in all routers but in several (better if cheapo ones), the downstream link under stress will behave differently depending on whether there is also traffic from upstream (expensive routers will shoulder whatever you throw at them without the least revealing twitch). Of course such behaviour isn't likely to go unnoticed.

  • tap the neighbours' apartment. Which is similar to the "bribe the router" case except this is even worse, now you need to install malicious code into the upstream router in order to tap its traffic. Such code exists for many routers, so if you're on the defensive side of the question - is there anyone who isn't? - you must contemplate the possible risk. A well-cared-for, well-maintained, modern router will minimize this risk. Changing the default access (if appropriate) on the router should have been the first priority after its purchase.

Monitoring the upstream router statistics and vital signs will go a long way towards identifying possible anomalies. Some routers also allow downloading the configuration from a secure address, so that it may be hashed and fingerprinted periodically.


You can generally only "sniff" the data that goes through devices (and thus connections) that you have access to. Unless you could redirect traffic (using ICMP redirects or so) from other "clients" to pass by your device first, it will be very difficult, if not impossible, to do.

  • to use iptables or ?
    – user50189
    Commented Jul 15, 2014 at 8:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .