Sniffing packets through router

The name of the pictureThe name of the pictureThe name of the pictureClash Royale CLAN TAG#URR8PPP












3















I would like to create a system like this.
enter image description here



The user would connect through a wifi network which would reroute all http requests and responses through the network card on a computer thus allowing that computer to sniff the packets. I have debian running on the computer. How would i go about doing this?










share|improve this question
























  • What's the OS on the router? If it's not a unix, we can't help you with that part.

    – Gilles
    Mar 28 '11 at 20:15











  • I don't know what the os is on the router, it is a fairly simple drink home router.

    – giodamelio
    Mar 28 '11 at 20:32











  • There's a point where you'll want to duplicate the packets (one copy for the sniffer and one copy to go to the modem). According to Howto: Copy/Tee/Clone network traffic using iptables by bjou, found from Copying packets from an interface to another, on Linux, this currently requires an additional kernel module.

    – Gilles
    Mar 28 '11 at 20:39















3















I would like to create a system like this.
enter image description here



The user would connect through a wifi network which would reroute all http requests and responses through the network card on a computer thus allowing that computer to sniff the packets. I have debian running on the computer. How would i go about doing this?










share|improve this question
























  • What's the OS on the router? If it's not a unix, we can't help you with that part.

    – Gilles
    Mar 28 '11 at 20:15











  • I don't know what the os is on the router, it is a fairly simple drink home router.

    – giodamelio
    Mar 28 '11 at 20:32











  • There's a point where you'll want to duplicate the packets (one copy for the sniffer and one copy to go to the modem). According to Howto: Copy/Tee/Clone network traffic using iptables by bjou, found from Copying packets from an interface to another, on Linux, this currently requires an additional kernel module.

    – Gilles
    Mar 28 '11 at 20:39













3












3








3


1






I would like to create a system like this.
enter image description here



The user would connect through a wifi network which would reroute all http requests and responses through the network card on a computer thus allowing that computer to sniff the packets. I have debian running on the computer. How would i go about doing this?










share|improve this question
















I would like to create a system like this.
enter image description here



The user would connect through a wifi network which would reroute all http requests and responses through the network card on a computer thus allowing that computer to sniff the packets. I have debian running on the computer. How would i go about doing this?







networking routing ip http-proxy






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited Dec 30 '18 at 20:35









Glorfindel

2311310




2311310










asked Mar 28 '11 at 4:51









giodameliogiodamelio

166111




166111












  • What's the OS on the router? If it's not a unix, we can't help you with that part.

    – Gilles
    Mar 28 '11 at 20:15











  • I don't know what the os is on the router, it is a fairly simple drink home router.

    – giodamelio
    Mar 28 '11 at 20:32











  • There's a point where you'll want to duplicate the packets (one copy for the sniffer and one copy to go to the modem). According to Howto: Copy/Tee/Clone network traffic using iptables by bjou, found from Copying packets from an interface to another, on Linux, this currently requires an additional kernel module.

    – Gilles
    Mar 28 '11 at 20:39

















  • What's the OS on the router? If it's not a unix, we can't help you with that part.

    – Gilles
    Mar 28 '11 at 20:15











  • I don't know what the os is on the router, it is a fairly simple drink home router.

    – giodamelio
    Mar 28 '11 at 20:32











  • There's a point where you'll want to duplicate the packets (one copy for the sniffer and one copy to go to the modem). According to Howto: Copy/Tee/Clone network traffic using iptables by bjou, found from Copying packets from an interface to another, on Linux, this currently requires an additional kernel module.

    – Gilles
    Mar 28 '11 at 20:39
















What's the OS on the router? If it's not a unix, we can't help you with that part.

– Gilles
Mar 28 '11 at 20:15





What's the OS on the router? If it's not a unix, we can't help you with that part.

– Gilles
Mar 28 '11 at 20:15













I don't know what the os is on the router, it is a fairly simple drink home router.

– giodamelio
Mar 28 '11 at 20:32





I don't know what the os is on the router, it is a fairly simple drink home router.

– giodamelio
Mar 28 '11 at 20:32













There's a point where you'll want to duplicate the packets (one copy for the sniffer and one copy to go to the modem). According to Howto: Copy/Tee/Clone network traffic using iptables by bjou, found from Copying packets from an interface to another, on Linux, this currently requires an additional kernel module.

– Gilles
Mar 28 '11 at 20:39





There's a point where you'll want to duplicate the packets (one copy for the sniffer and one copy to go to the modem). According to Howto: Copy/Tee/Clone network traffic using iptables by bjou, found from Copying packets from an interface to another, on Linux, this currently requires an additional kernel module.

– Gilles
Mar 28 '11 at 20:39










4 Answers
4






active

oldest

votes


















2














Get a 10/100 ethernet hub, a real hub, like a Netgear DS104. Put it between the wifi and the router. Hubs replicate traffic on all ports, so you can connect a separate machine to another port on the hub and sniff everything.






share|improve this answer























  • It seems that this will be the easiest way to do the job, thanks.

    – giodamelio
    Mar 28 '11 at 20:34


















2














Unless your brand of router specifically allows for that kind of interception (most don't unless you're talking about industrial grade stuff with triple digit costs and usage licenses) I'm afraid you're sunk; a better bet might be to install a wifi card in your computer and try to sniff the wireless traffic directly using something like wireshark or Kismet.






share|improve this answer























  • I was thinking about getting a little creative with my hardware, What is I were to connect the Ethernet in on my router to my computer with a cat5 cable then use tshark to sniff the packets before redirecting all the data back to the ip of the modem. If that was confusing just tell me, ill draw up another diagram.

    – giodamelio
    Mar 28 '11 at 10:00











  • here is a pic gyazo.com/45210b1932d7140cdc160b3a672173c6.png

    – giodamelio
    Mar 28 '11 at 10:10











  • A wifi card and Kismet/wireshark will likely cost you way less in terms of overhead. In the setup you're describing in that picture you're essentially telling your router to use the sniffer box as default router, and the sniffer then forwarding traffic to the actual modem...

    – Shadur
    Mar 28 '11 at 11:18


















1














You can connect modem directly to your computer and make router so send all traffic through your debian system. In this case you may do anything you want with packets.



P.S.: do you need something like this?






share|improve this answer






























    0














    tcpdump -i ethX -w capturefile net x.x.x.x/y


    Where ethX the card which receives this traffic and x.x.x.x/y is the cidr of the wireless network. This should capture anything coming or going to this network and save it to "capturefile" file. Add and port 80 in the end if you want only web traffic.



    This looks like a "honeypot" setup. If you are trying to capture http sessions and/or other private information, this is illegal. Even if those users are trying to steal your internet connection. Unless you've acquired permission from those who use the wireless network, this is probably illegal.



    EDIT:



    I thought you already had setup the rerouting part. If you're asking how to reroute the specific traffic, it is possible but it depends on the hardware you have and probably I can't help you on that.






    share|improve this answer

























    • If it's his own wireless network I don't see why it'd be illegal to sniff on it - if I'd need written permission from every single customer of our ISP before being allowed to run tcpdump or wireshark to debug a problem I'd never get anything done.

      – Shadur
      Mar 28 '11 at 11:20











    • Sorry, I wasn't clear enough, my bad. I meant it is illegal if he wants to capture live http sessions and steal cookies or passwords. I can't see any other use for this setup, or he'd probably need a proxy server.

      – forcefsck
      Mar 28 '11 at 11:30










    Your Answer








    StackExchange.ready(function()
    var channelOptions =
    tags: "".split(" "),
    id: "106"
    ;
    initTagRenderer("".split(" "), "".split(" "), channelOptions);

    StackExchange.using("externalEditor", function()
    // Have to fire editor after snippets, if snippets enabled
    if (StackExchange.settings.snippets.snippetsEnabled)
    StackExchange.using("snippets", function()
    createEditor();
    );

    else
    createEditor();

    );

    function createEditor()
    StackExchange.prepareEditor(
    heartbeatType: 'answer',
    autoActivateHeartbeat: false,
    convertImagesToLinks: false,
    noModals: true,
    showLowRepImageUploadWarning: true,
    reputationToPostImages: null,
    bindNavPrevention: true,
    postfix: "",
    imageUploader:
    brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
    contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
    allowUrls: true
    ,
    onDemand: true,
    discardSelector: ".discard-answer"
    ,immediatelyShowMarkdownHelp:true
    );



    );













    draft saved

    draft discarded


















    StackExchange.ready(
    function ()
    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f10206%2fsniffing-packets-through-router%23new-answer', 'question_page');

    );

    Post as a guest















    Required, but never shown

























    4 Answers
    4






    active

    oldest

    votes








    4 Answers
    4






    active

    oldest

    votes









    active

    oldest

    votes






    active

    oldest

    votes









    2














    Get a 10/100 ethernet hub, a real hub, like a Netgear DS104. Put it between the wifi and the router. Hubs replicate traffic on all ports, so you can connect a separate machine to another port on the hub and sniff everything.






    share|improve this answer























    • It seems that this will be the easiest way to do the job, thanks.

      – giodamelio
      Mar 28 '11 at 20:34















    2














    Get a 10/100 ethernet hub, a real hub, like a Netgear DS104. Put it between the wifi and the router. Hubs replicate traffic on all ports, so you can connect a separate machine to another port on the hub and sniff everything.






    share|improve this answer























    • It seems that this will be the easiest way to do the job, thanks.

      – giodamelio
      Mar 28 '11 at 20:34













    2












    2








    2







    Get a 10/100 ethernet hub, a real hub, like a Netgear DS104. Put it between the wifi and the router. Hubs replicate traffic on all ports, so you can connect a separate machine to another port on the hub and sniff everything.






    share|improve this answer













    Get a 10/100 ethernet hub, a real hub, like a Netgear DS104. Put it between the wifi and the router. Hubs replicate traffic on all ports, so you can connect a separate machine to another port on the hub and sniff everything.







    share|improve this answer












    share|improve this answer



    share|improve this answer










    answered Mar 28 '11 at 14:25









    LawrenceCLawrenceC

    8,47222440




    8,47222440












    • It seems that this will be the easiest way to do the job, thanks.

      – giodamelio
      Mar 28 '11 at 20:34

















    • It seems that this will be the easiest way to do the job, thanks.

      – giodamelio
      Mar 28 '11 at 20:34
















    It seems that this will be the easiest way to do the job, thanks.

    – giodamelio
    Mar 28 '11 at 20:34





    It seems that this will be the easiest way to do the job, thanks.

    – giodamelio
    Mar 28 '11 at 20:34













    2














    Unless your brand of router specifically allows for that kind of interception (most don't unless you're talking about industrial grade stuff with triple digit costs and usage licenses) I'm afraid you're sunk; a better bet might be to install a wifi card in your computer and try to sniff the wireless traffic directly using something like wireshark or Kismet.






    share|improve this answer























    • I was thinking about getting a little creative with my hardware, What is I were to connect the Ethernet in on my router to my computer with a cat5 cable then use tshark to sniff the packets before redirecting all the data back to the ip of the modem. If that was confusing just tell me, ill draw up another diagram.

      – giodamelio
      Mar 28 '11 at 10:00











    • here is a pic gyazo.com/45210b1932d7140cdc160b3a672173c6.png

      – giodamelio
      Mar 28 '11 at 10:10











    • A wifi card and Kismet/wireshark will likely cost you way less in terms of overhead. In the setup you're describing in that picture you're essentially telling your router to use the sniffer box as default router, and the sniffer then forwarding traffic to the actual modem...

      – Shadur
      Mar 28 '11 at 11:18















    2














    Unless your brand of router specifically allows for that kind of interception (most don't unless you're talking about industrial grade stuff with triple digit costs and usage licenses) I'm afraid you're sunk; a better bet might be to install a wifi card in your computer and try to sniff the wireless traffic directly using something like wireshark or Kismet.






    share|improve this answer























    • I was thinking about getting a little creative with my hardware, What is I were to connect the Ethernet in on my router to my computer with a cat5 cable then use tshark to sniff the packets before redirecting all the data back to the ip of the modem. If that was confusing just tell me, ill draw up another diagram.

      – giodamelio
      Mar 28 '11 at 10:00











    • here is a pic gyazo.com/45210b1932d7140cdc160b3a672173c6.png

      – giodamelio
      Mar 28 '11 at 10:10











    • A wifi card and Kismet/wireshark will likely cost you way less in terms of overhead. In the setup you're describing in that picture you're essentially telling your router to use the sniffer box as default router, and the sniffer then forwarding traffic to the actual modem...

      – Shadur
      Mar 28 '11 at 11:18













    2












    2








    2







    Unless your brand of router specifically allows for that kind of interception (most don't unless you're talking about industrial grade stuff with triple digit costs and usage licenses) I'm afraid you're sunk; a better bet might be to install a wifi card in your computer and try to sniff the wireless traffic directly using something like wireshark or Kismet.






    share|improve this answer













    Unless your brand of router specifically allows for that kind of interception (most don't unless you're talking about industrial grade stuff with triple digit costs and usage licenses) I'm afraid you're sunk; a better bet might be to install a wifi card in your computer and try to sniff the wireless traffic directly using something like wireshark or Kismet.







    share|improve this answer












    share|improve this answer



    share|improve this answer










    answered Mar 28 '11 at 7:17









    ShadurShadur

    19.5k74357




    19.5k74357












    • I was thinking about getting a little creative with my hardware, What is I were to connect the Ethernet in on my router to my computer with a cat5 cable then use tshark to sniff the packets before redirecting all the data back to the ip of the modem. If that was confusing just tell me, ill draw up another diagram.

      – giodamelio
      Mar 28 '11 at 10:00











    • here is a pic gyazo.com/45210b1932d7140cdc160b3a672173c6.png

      – giodamelio
      Mar 28 '11 at 10:10











    • A wifi card and Kismet/wireshark will likely cost you way less in terms of overhead. In the setup you're describing in that picture you're essentially telling your router to use the sniffer box as default router, and the sniffer then forwarding traffic to the actual modem...

      – Shadur
      Mar 28 '11 at 11:18

















    • I was thinking about getting a little creative with my hardware, What is I were to connect the Ethernet in on my router to my computer with a cat5 cable then use tshark to sniff the packets before redirecting all the data back to the ip of the modem. If that was confusing just tell me, ill draw up another diagram.

      – giodamelio
      Mar 28 '11 at 10:00











    • here is a pic gyazo.com/45210b1932d7140cdc160b3a672173c6.png

      – giodamelio
      Mar 28 '11 at 10:10











    • A wifi card and Kismet/wireshark will likely cost you way less in terms of overhead. In the setup you're describing in that picture you're essentially telling your router to use the sniffer box as default router, and the sniffer then forwarding traffic to the actual modem...

      – Shadur
      Mar 28 '11 at 11:18
















    I was thinking about getting a little creative with my hardware, What is I were to connect the Ethernet in on my router to my computer with a cat5 cable then use tshark to sniff the packets before redirecting all the data back to the ip of the modem. If that was confusing just tell me, ill draw up another diagram.

    – giodamelio
    Mar 28 '11 at 10:00





    I was thinking about getting a little creative with my hardware, What is I were to connect the Ethernet in on my router to my computer with a cat5 cable then use tshark to sniff the packets before redirecting all the data back to the ip of the modem. If that was confusing just tell me, ill draw up another diagram.

    – giodamelio
    Mar 28 '11 at 10:00













    here is a pic gyazo.com/45210b1932d7140cdc160b3a672173c6.png

    – giodamelio
    Mar 28 '11 at 10:10





    here is a pic gyazo.com/45210b1932d7140cdc160b3a672173c6.png

    – giodamelio
    Mar 28 '11 at 10:10













    A wifi card and Kismet/wireshark will likely cost you way less in terms of overhead. In the setup you're describing in that picture you're essentially telling your router to use the sniffer box as default router, and the sniffer then forwarding traffic to the actual modem...

    – Shadur
    Mar 28 '11 at 11:18





    A wifi card and Kismet/wireshark will likely cost you way less in terms of overhead. In the setup you're describing in that picture you're essentially telling your router to use the sniffer box as default router, and the sniffer then forwarding traffic to the actual modem...

    – Shadur
    Mar 28 '11 at 11:18











    1














    You can connect modem directly to your computer and make router so send all traffic through your debian system. In this case you may do anything you want with packets.



    P.S.: do you need something like this?






    share|improve this answer



























      1














      You can connect modem directly to your computer and make router so send all traffic through your debian system. In this case you may do anything you want with packets.



      P.S.: do you need something like this?






      share|improve this answer

























        1












        1








        1







        You can connect modem directly to your computer and make router so send all traffic through your debian system. In this case you may do anything you want with packets.



        P.S.: do you need something like this?






        share|improve this answer













        You can connect modem directly to your computer and make router so send all traffic through your debian system. In this case you may do anything you want with packets.



        P.S.: do you need something like this?







        share|improve this answer












        share|improve this answer



        share|improve this answer










        answered Mar 28 '11 at 10:22









        gelraengelraen

        4,53011316




        4,53011316





















            0














            tcpdump -i ethX -w capturefile net x.x.x.x/y


            Where ethX the card which receives this traffic and x.x.x.x/y is the cidr of the wireless network. This should capture anything coming or going to this network and save it to "capturefile" file. Add and port 80 in the end if you want only web traffic.



            This looks like a "honeypot" setup. If you are trying to capture http sessions and/or other private information, this is illegal. Even if those users are trying to steal your internet connection. Unless you've acquired permission from those who use the wireless network, this is probably illegal.



            EDIT:



            I thought you already had setup the rerouting part. If you're asking how to reroute the specific traffic, it is possible but it depends on the hardware you have and probably I can't help you on that.






            share|improve this answer

























            • If it's his own wireless network I don't see why it'd be illegal to sniff on it - if I'd need written permission from every single customer of our ISP before being allowed to run tcpdump or wireshark to debug a problem I'd never get anything done.

              – Shadur
              Mar 28 '11 at 11:20











            • Sorry, I wasn't clear enough, my bad. I meant it is illegal if he wants to capture live http sessions and steal cookies or passwords. I can't see any other use for this setup, or he'd probably need a proxy server.

              – forcefsck
              Mar 28 '11 at 11:30















            0














            tcpdump -i ethX -w capturefile net x.x.x.x/y


            Where ethX the card which receives this traffic and x.x.x.x/y is the cidr of the wireless network. This should capture anything coming or going to this network and save it to "capturefile" file. Add and port 80 in the end if you want only web traffic.



            This looks like a "honeypot" setup. If you are trying to capture http sessions and/or other private information, this is illegal. Even if those users are trying to steal your internet connection. Unless you've acquired permission from those who use the wireless network, this is probably illegal.



            EDIT:



            I thought you already had setup the rerouting part. If you're asking how to reroute the specific traffic, it is possible but it depends on the hardware you have and probably I can't help you on that.






            share|improve this answer

























            • If it's his own wireless network I don't see why it'd be illegal to sniff on it - if I'd need written permission from every single customer of our ISP before being allowed to run tcpdump or wireshark to debug a problem I'd never get anything done.

              – Shadur
              Mar 28 '11 at 11:20











            • Sorry, I wasn't clear enough, my bad. I meant it is illegal if he wants to capture live http sessions and steal cookies or passwords. I can't see any other use for this setup, or he'd probably need a proxy server.

              – forcefsck
              Mar 28 '11 at 11:30













            0












            0








            0







            tcpdump -i ethX -w capturefile net x.x.x.x/y


            Where ethX the card which receives this traffic and x.x.x.x/y is the cidr of the wireless network. This should capture anything coming or going to this network and save it to "capturefile" file. Add and port 80 in the end if you want only web traffic.



            This looks like a "honeypot" setup. If you are trying to capture http sessions and/or other private information, this is illegal. Even if those users are trying to steal your internet connection. Unless you've acquired permission from those who use the wireless network, this is probably illegal.



            EDIT:



            I thought you already had setup the rerouting part. If you're asking how to reroute the specific traffic, it is possible but it depends on the hardware you have and probably I can't help you on that.






            share|improve this answer















            tcpdump -i ethX -w capturefile net x.x.x.x/y


            Where ethX the card which receives this traffic and x.x.x.x/y is the cidr of the wireless network. This should capture anything coming or going to this network and save it to "capturefile" file. Add and port 80 in the end if you want only web traffic.



            This looks like a "honeypot" setup. If you are trying to capture http sessions and/or other private information, this is illegal. Even if those users are trying to steal your internet connection. Unless you've acquired permission from those who use the wireless network, this is probably illegal.



            EDIT:



            I thought you already had setup the rerouting part. If you're asking how to reroute the specific traffic, it is possible but it depends on the hardware you have and probably I can't help you on that.







            share|improve this answer














            share|improve this answer



            share|improve this answer








            edited Mar 28 '11 at 11:41

























            answered Mar 28 '11 at 9:00









            forcefsckforcefsck

            5,6661931




            5,6661931












            • If it's his own wireless network I don't see why it'd be illegal to sniff on it - if I'd need written permission from every single customer of our ISP before being allowed to run tcpdump or wireshark to debug a problem I'd never get anything done.

              – Shadur
              Mar 28 '11 at 11:20











            • Sorry, I wasn't clear enough, my bad. I meant it is illegal if he wants to capture live http sessions and steal cookies or passwords. I can't see any other use for this setup, or he'd probably need a proxy server.

              – forcefsck
              Mar 28 '11 at 11:30

















            • If it's his own wireless network I don't see why it'd be illegal to sniff on it - if I'd need written permission from every single customer of our ISP before being allowed to run tcpdump or wireshark to debug a problem I'd never get anything done.

              – Shadur
              Mar 28 '11 at 11:20











            • Sorry, I wasn't clear enough, my bad. I meant it is illegal if he wants to capture live http sessions and steal cookies or passwords. I can't see any other use for this setup, or he'd probably need a proxy server.

              – forcefsck
              Mar 28 '11 at 11:30
















            If it's his own wireless network I don't see why it'd be illegal to sniff on it - if I'd need written permission from every single customer of our ISP before being allowed to run tcpdump or wireshark to debug a problem I'd never get anything done.

            – Shadur
            Mar 28 '11 at 11:20





            If it's his own wireless network I don't see why it'd be illegal to sniff on it - if I'd need written permission from every single customer of our ISP before being allowed to run tcpdump or wireshark to debug a problem I'd never get anything done.

            – Shadur
            Mar 28 '11 at 11:20













            Sorry, I wasn't clear enough, my bad. I meant it is illegal if he wants to capture live http sessions and steal cookies or passwords. I can't see any other use for this setup, or he'd probably need a proxy server.

            – forcefsck
            Mar 28 '11 at 11:30





            Sorry, I wasn't clear enough, my bad. I meant it is illegal if he wants to capture live http sessions and steal cookies or passwords. I can't see any other use for this setup, or he'd probably need a proxy server.

            – forcefsck
            Mar 28 '11 at 11:30

















            draft saved

            draft discarded
















































            Thanks for contributing an answer to Unix & Linux Stack Exchange!


            • Please be sure to answer the question. Provide details and share your research!

            But avoid


            • Asking for help, clarification, or responding to other answers.

            • Making statements based on opinion; back them up with references or personal experience.

            To learn more, see our tips on writing great answers.




            draft saved


            draft discarded














            StackExchange.ready(
            function ()
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f10206%2fsniffing-packets-through-router%23new-answer', 'question_page');

            );

            Post as a guest















            Required, but never shown





















































            Required, but never shown














            Required, but never shown












            Required, but never shown







            Required, but never shown

































            Required, but never shown














            Required, but never shown












            Required, but never shown







            Required, but never shown






            Popular posts from this blog

            Peggy Mitchell

            Palaiologos

            The Forum (Inglewood, California)