Sniffing packets through router

Clash Royale CLAN TAG#URR8PPP
I would like to create a system like this.
The user would connect through a wifi network which would reroute all http requests and responses through the network card on a computer thus allowing that computer to sniff the packets. I have debian running on the computer. How would i go about doing this?
networking routing ip http-proxy
add a comment |
I would like to create a system like this.
The user would connect through a wifi network which would reroute all http requests and responses through the network card on a computer thus allowing that computer to sniff the packets. I have debian running on the computer. How would i go about doing this?
networking routing ip http-proxy
What's the OS on the router? If it's not a unix, we can't help you with that part.
– Gilles
Mar 28 '11 at 20:15
I don't know what the os is on the router, it is a fairly simple drink home router.
– giodamelio
Mar 28 '11 at 20:32
There's a point where you'll want to duplicate the packets (one copy for the sniffer and one copy to go to the modem). According to Howto: Copy/Tee/Clone network traffic using iptables by bjou, found from Copying packets from an interface to another, on Linux, this currently requires an additional kernel module.
– Gilles
Mar 28 '11 at 20:39
add a comment |
I would like to create a system like this.
The user would connect through a wifi network which would reroute all http requests and responses through the network card on a computer thus allowing that computer to sniff the packets. I have debian running on the computer. How would i go about doing this?
networking routing ip http-proxy
I would like to create a system like this.
The user would connect through a wifi network which would reroute all http requests and responses through the network card on a computer thus allowing that computer to sniff the packets. I have debian running on the computer. How would i go about doing this?
networking routing ip http-proxy
networking routing ip http-proxy
edited Dec 30 '18 at 20:35
Glorfindel
2311310
2311310
asked Mar 28 '11 at 4:51
giodameliogiodamelio
166111
166111
What's the OS on the router? If it's not a unix, we can't help you with that part.
– Gilles
Mar 28 '11 at 20:15
I don't know what the os is on the router, it is a fairly simple drink home router.
– giodamelio
Mar 28 '11 at 20:32
There's a point where you'll want to duplicate the packets (one copy for the sniffer and one copy to go to the modem). According to Howto: Copy/Tee/Clone network traffic using iptables by bjou, found from Copying packets from an interface to another, on Linux, this currently requires an additional kernel module.
– Gilles
Mar 28 '11 at 20:39
add a comment |
What's the OS on the router? If it's not a unix, we can't help you with that part.
– Gilles
Mar 28 '11 at 20:15
I don't know what the os is on the router, it is a fairly simple drink home router.
– giodamelio
Mar 28 '11 at 20:32
There's a point where you'll want to duplicate the packets (one copy for the sniffer and one copy to go to the modem). According to Howto: Copy/Tee/Clone network traffic using iptables by bjou, found from Copying packets from an interface to another, on Linux, this currently requires an additional kernel module.
– Gilles
Mar 28 '11 at 20:39
What's the OS on the router? If it's not a unix, we can't help you with that part.
– Gilles
Mar 28 '11 at 20:15
What's the OS on the router? If it's not a unix, we can't help you with that part.
– Gilles
Mar 28 '11 at 20:15
I don't know what the os is on the router, it is a fairly simple drink home router.
– giodamelio
Mar 28 '11 at 20:32
I don't know what the os is on the router, it is a fairly simple drink home router.
– giodamelio
Mar 28 '11 at 20:32
There's a point where you'll want to duplicate the packets (one copy for the sniffer and one copy to go to the modem). According to Howto: Copy/Tee/Clone network traffic using iptables by bjou, found from Copying packets from an interface to another, on Linux, this currently requires an additional kernel module.
– Gilles
Mar 28 '11 at 20:39
There's a point where you'll want to duplicate the packets (one copy for the sniffer and one copy to go to the modem). According to Howto: Copy/Tee/Clone network traffic using iptables by bjou, found from Copying packets from an interface to another, on Linux, this currently requires an additional kernel module.
– Gilles
Mar 28 '11 at 20:39
add a comment |
4 Answers
4
active
oldest
votes
Get a 10/100 ethernet hub, a real hub, like a Netgear DS104. Put it between the wifi and the router. Hubs replicate traffic on all ports, so you can connect a separate machine to another port on the hub and sniff everything.
It seems that this will be the easiest way to do the job, thanks.
– giodamelio
Mar 28 '11 at 20:34
add a comment |
Unless your brand of router specifically allows for that kind of interception (most don't unless you're talking about industrial grade stuff with triple digit costs and usage licenses) I'm afraid you're sunk; a better bet might be to install a wifi card in your computer and try to sniff the wireless traffic directly using something like wireshark or Kismet.
I was thinking about getting a little creative with my hardware, What is I were to connect the Ethernet in on my router to my computer with a cat5 cable then use tshark to sniff the packets before redirecting all the data back to the ip of the modem. If that was confusing just tell me, ill draw up another diagram.
– giodamelio
Mar 28 '11 at 10:00
here is a pic gyazo.com/45210b1932d7140cdc160b3a672173c6.png
– giodamelio
Mar 28 '11 at 10:10
A wifi card and Kismet/wireshark will likely cost you way less in terms of overhead. In the setup you're describing in that picture you're essentially telling your router to use the sniffer box as default router, and the sniffer then forwarding traffic to the actual modem...
– Shadur
Mar 28 '11 at 11:18
add a comment |
You can connect modem directly to your computer and make router so send all traffic through your debian system. In this case you may do anything you want with packets.
P.S.: do you need something like this?
add a comment |
tcpdump -i ethX -w capturefile net x.x.x.x/y
Where ethX the card which receives this traffic and x.x.x.x/y is the cidr of the wireless network. This should capture anything coming or going to this network and save it to "capturefile" file. Add and port 80 in the end if you want only web traffic.
This looks like a "honeypot" setup. If you are trying to capture http sessions and/or other private information, this is illegal. Even if those users are trying to steal your internet connection. Unless you've acquired permission from those who use the wireless network, this is probably illegal.
EDIT:
I thought you already had setup the rerouting part. If you're asking how to reroute the specific traffic, it is possible but it depends on the hardware you have and probably I can't help you on that.
If it's his own wireless network I don't see why it'd be illegal to sniff on it - if I'd need written permission from every single customer of our ISP before being allowed to run tcpdump or wireshark to debug a problem I'd never get anything done.
– Shadur
Mar 28 '11 at 11:20
Sorry, I wasn't clear enough, my bad. I meant it is illegal if he wants to capture live http sessions and steal cookies or passwords. I can't see any other use for this setup, or he'd probably need a proxy server.
– forcefsck
Mar 28 '11 at 11:30
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "106"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f10206%2fsniffing-packets-through-router%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
4 Answers
4
active
oldest
votes
4 Answers
4
active
oldest
votes
active
oldest
votes
active
oldest
votes
Get a 10/100 ethernet hub, a real hub, like a Netgear DS104. Put it between the wifi and the router. Hubs replicate traffic on all ports, so you can connect a separate machine to another port on the hub and sniff everything.
It seems that this will be the easiest way to do the job, thanks.
– giodamelio
Mar 28 '11 at 20:34
add a comment |
Get a 10/100 ethernet hub, a real hub, like a Netgear DS104. Put it between the wifi and the router. Hubs replicate traffic on all ports, so you can connect a separate machine to another port on the hub and sniff everything.
It seems that this will be the easiest way to do the job, thanks.
– giodamelio
Mar 28 '11 at 20:34
add a comment |
Get a 10/100 ethernet hub, a real hub, like a Netgear DS104. Put it between the wifi and the router. Hubs replicate traffic on all ports, so you can connect a separate machine to another port on the hub and sniff everything.
Get a 10/100 ethernet hub, a real hub, like a Netgear DS104. Put it between the wifi and the router. Hubs replicate traffic on all ports, so you can connect a separate machine to another port on the hub and sniff everything.
answered Mar 28 '11 at 14:25
LawrenceCLawrenceC
8,47222440
8,47222440
It seems that this will be the easiest way to do the job, thanks.
– giodamelio
Mar 28 '11 at 20:34
add a comment |
It seems that this will be the easiest way to do the job, thanks.
– giodamelio
Mar 28 '11 at 20:34
It seems that this will be the easiest way to do the job, thanks.
– giodamelio
Mar 28 '11 at 20:34
It seems that this will be the easiest way to do the job, thanks.
– giodamelio
Mar 28 '11 at 20:34
add a comment |
Unless your brand of router specifically allows for that kind of interception (most don't unless you're talking about industrial grade stuff with triple digit costs and usage licenses) I'm afraid you're sunk; a better bet might be to install a wifi card in your computer and try to sniff the wireless traffic directly using something like wireshark or Kismet.
I was thinking about getting a little creative with my hardware, What is I were to connect the Ethernet in on my router to my computer with a cat5 cable then use tshark to sniff the packets before redirecting all the data back to the ip of the modem. If that was confusing just tell me, ill draw up another diagram.
– giodamelio
Mar 28 '11 at 10:00
here is a pic gyazo.com/45210b1932d7140cdc160b3a672173c6.png
– giodamelio
Mar 28 '11 at 10:10
A wifi card and Kismet/wireshark will likely cost you way less in terms of overhead. In the setup you're describing in that picture you're essentially telling your router to use the sniffer box as default router, and the sniffer then forwarding traffic to the actual modem...
– Shadur
Mar 28 '11 at 11:18
add a comment |
Unless your brand of router specifically allows for that kind of interception (most don't unless you're talking about industrial grade stuff with triple digit costs and usage licenses) I'm afraid you're sunk; a better bet might be to install a wifi card in your computer and try to sniff the wireless traffic directly using something like wireshark or Kismet.
I was thinking about getting a little creative with my hardware, What is I were to connect the Ethernet in on my router to my computer with a cat5 cable then use tshark to sniff the packets before redirecting all the data back to the ip of the modem. If that was confusing just tell me, ill draw up another diagram.
– giodamelio
Mar 28 '11 at 10:00
here is a pic gyazo.com/45210b1932d7140cdc160b3a672173c6.png
– giodamelio
Mar 28 '11 at 10:10
A wifi card and Kismet/wireshark will likely cost you way less in terms of overhead. In the setup you're describing in that picture you're essentially telling your router to use the sniffer box as default router, and the sniffer then forwarding traffic to the actual modem...
– Shadur
Mar 28 '11 at 11:18
add a comment |
Unless your brand of router specifically allows for that kind of interception (most don't unless you're talking about industrial grade stuff with triple digit costs and usage licenses) I'm afraid you're sunk; a better bet might be to install a wifi card in your computer and try to sniff the wireless traffic directly using something like wireshark or Kismet.
Unless your brand of router specifically allows for that kind of interception (most don't unless you're talking about industrial grade stuff with triple digit costs and usage licenses) I'm afraid you're sunk; a better bet might be to install a wifi card in your computer and try to sniff the wireless traffic directly using something like wireshark or Kismet.
answered Mar 28 '11 at 7:17
ShadurShadur
19.5k74357
19.5k74357
I was thinking about getting a little creative with my hardware, What is I were to connect the Ethernet in on my router to my computer with a cat5 cable then use tshark to sniff the packets before redirecting all the data back to the ip of the modem. If that was confusing just tell me, ill draw up another diagram.
– giodamelio
Mar 28 '11 at 10:00
here is a pic gyazo.com/45210b1932d7140cdc160b3a672173c6.png
– giodamelio
Mar 28 '11 at 10:10
A wifi card and Kismet/wireshark will likely cost you way less in terms of overhead. In the setup you're describing in that picture you're essentially telling your router to use the sniffer box as default router, and the sniffer then forwarding traffic to the actual modem...
– Shadur
Mar 28 '11 at 11:18
add a comment |
I was thinking about getting a little creative with my hardware, What is I were to connect the Ethernet in on my router to my computer with a cat5 cable then use tshark to sniff the packets before redirecting all the data back to the ip of the modem. If that was confusing just tell me, ill draw up another diagram.
– giodamelio
Mar 28 '11 at 10:00
here is a pic gyazo.com/45210b1932d7140cdc160b3a672173c6.png
– giodamelio
Mar 28 '11 at 10:10
A wifi card and Kismet/wireshark will likely cost you way less in terms of overhead. In the setup you're describing in that picture you're essentially telling your router to use the sniffer box as default router, and the sniffer then forwarding traffic to the actual modem...
– Shadur
Mar 28 '11 at 11:18
I was thinking about getting a little creative with my hardware, What is I were to connect the Ethernet in on my router to my computer with a cat5 cable then use tshark to sniff the packets before redirecting all the data back to the ip of the modem. If that was confusing just tell me, ill draw up another diagram.
– giodamelio
Mar 28 '11 at 10:00
I was thinking about getting a little creative with my hardware, What is I were to connect the Ethernet in on my router to my computer with a cat5 cable then use tshark to sniff the packets before redirecting all the data back to the ip of the modem. If that was confusing just tell me, ill draw up another diagram.
– giodamelio
Mar 28 '11 at 10:00
here is a pic gyazo.com/45210b1932d7140cdc160b3a672173c6.png
– giodamelio
Mar 28 '11 at 10:10
here is a pic gyazo.com/45210b1932d7140cdc160b3a672173c6.png
– giodamelio
Mar 28 '11 at 10:10
A wifi card and Kismet/wireshark will likely cost you way less in terms of overhead. In the setup you're describing in that picture you're essentially telling your router to use the sniffer box as default router, and the sniffer then forwarding traffic to the actual modem...
– Shadur
Mar 28 '11 at 11:18
A wifi card and Kismet/wireshark will likely cost you way less in terms of overhead. In the setup you're describing in that picture you're essentially telling your router to use the sniffer box as default router, and the sniffer then forwarding traffic to the actual modem...
– Shadur
Mar 28 '11 at 11:18
add a comment |
You can connect modem directly to your computer and make router so send all traffic through your debian system. In this case you may do anything you want with packets.
P.S.: do you need something like this?
add a comment |
You can connect modem directly to your computer and make router so send all traffic through your debian system. In this case you may do anything you want with packets.
P.S.: do you need something like this?
add a comment |
You can connect modem directly to your computer and make router so send all traffic through your debian system. In this case you may do anything you want with packets.
P.S.: do you need something like this?
You can connect modem directly to your computer and make router so send all traffic through your debian system. In this case you may do anything you want with packets.
P.S.: do you need something like this?
answered Mar 28 '11 at 10:22
gelraengelraen
4,53011316
4,53011316
add a comment |
add a comment |
tcpdump -i ethX -w capturefile net x.x.x.x/y
Where ethX the card which receives this traffic and x.x.x.x/y is the cidr of the wireless network. This should capture anything coming or going to this network and save it to "capturefile" file. Add and port 80 in the end if you want only web traffic.
This looks like a "honeypot" setup. If you are trying to capture http sessions and/or other private information, this is illegal. Even if those users are trying to steal your internet connection. Unless you've acquired permission from those who use the wireless network, this is probably illegal.
EDIT:
I thought you already had setup the rerouting part. If you're asking how to reroute the specific traffic, it is possible but it depends on the hardware you have and probably I can't help you on that.
If it's his own wireless network I don't see why it'd be illegal to sniff on it - if I'd need written permission from every single customer of our ISP before being allowed to run tcpdump or wireshark to debug a problem I'd never get anything done.
– Shadur
Mar 28 '11 at 11:20
Sorry, I wasn't clear enough, my bad. I meant it is illegal if he wants to capture live http sessions and steal cookies or passwords. I can't see any other use for this setup, or he'd probably need a proxy server.
– forcefsck
Mar 28 '11 at 11:30
add a comment |
tcpdump -i ethX -w capturefile net x.x.x.x/y
Where ethX the card which receives this traffic and x.x.x.x/y is the cidr of the wireless network. This should capture anything coming or going to this network and save it to "capturefile" file. Add and port 80 in the end if you want only web traffic.
This looks like a "honeypot" setup. If you are trying to capture http sessions and/or other private information, this is illegal. Even if those users are trying to steal your internet connection. Unless you've acquired permission from those who use the wireless network, this is probably illegal.
EDIT:
I thought you already had setup the rerouting part. If you're asking how to reroute the specific traffic, it is possible but it depends on the hardware you have and probably I can't help you on that.
If it's his own wireless network I don't see why it'd be illegal to sniff on it - if I'd need written permission from every single customer of our ISP before being allowed to run tcpdump or wireshark to debug a problem I'd never get anything done.
– Shadur
Mar 28 '11 at 11:20
Sorry, I wasn't clear enough, my bad. I meant it is illegal if he wants to capture live http sessions and steal cookies or passwords. I can't see any other use for this setup, or he'd probably need a proxy server.
– forcefsck
Mar 28 '11 at 11:30
add a comment |
tcpdump -i ethX -w capturefile net x.x.x.x/y
Where ethX the card which receives this traffic and x.x.x.x/y is the cidr of the wireless network. This should capture anything coming or going to this network and save it to "capturefile" file. Add and port 80 in the end if you want only web traffic.
This looks like a "honeypot" setup. If you are trying to capture http sessions and/or other private information, this is illegal. Even if those users are trying to steal your internet connection. Unless you've acquired permission from those who use the wireless network, this is probably illegal.
EDIT:
I thought you already had setup the rerouting part. If you're asking how to reroute the specific traffic, it is possible but it depends on the hardware you have and probably I can't help you on that.
tcpdump -i ethX -w capturefile net x.x.x.x/y
Where ethX the card which receives this traffic and x.x.x.x/y is the cidr of the wireless network. This should capture anything coming or going to this network and save it to "capturefile" file. Add and port 80 in the end if you want only web traffic.
This looks like a "honeypot" setup. If you are trying to capture http sessions and/or other private information, this is illegal. Even if those users are trying to steal your internet connection. Unless you've acquired permission from those who use the wireless network, this is probably illegal.
EDIT:
I thought you already had setup the rerouting part. If you're asking how to reroute the specific traffic, it is possible but it depends on the hardware you have and probably I can't help you on that.
edited Mar 28 '11 at 11:41
answered Mar 28 '11 at 9:00
forcefsckforcefsck
5,6661931
5,6661931
If it's his own wireless network I don't see why it'd be illegal to sniff on it - if I'd need written permission from every single customer of our ISP before being allowed to run tcpdump or wireshark to debug a problem I'd never get anything done.
– Shadur
Mar 28 '11 at 11:20
Sorry, I wasn't clear enough, my bad. I meant it is illegal if he wants to capture live http sessions and steal cookies or passwords. I can't see any other use for this setup, or he'd probably need a proxy server.
– forcefsck
Mar 28 '11 at 11:30
add a comment |
If it's his own wireless network I don't see why it'd be illegal to sniff on it - if I'd need written permission from every single customer of our ISP before being allowed to run tcpdump or wireshark to debug a problem I'd never get anything done.
– Shadur
Mar 28 '11 at 11:20
Sorry, I wasn't clear enough, my bad. I meant it is illegal if he wants to capture live http sessions and steal cookies or passwords. I can't see any other use for this setup, or he'd probably need a proxy server.
– forcefsck
Mar 28 '11 at 11:30
If it's his own wireless network I don't see why it'd be illegal to sniff on it - if I'd need written permission from every single customer of our ISP before being allowed to run tcpdump or wireshark to debug a problem I'd never get anything done.
– Shadur
Mar 28 '11 at 11:20
If it's his own wireless network I don't see why it'd be illegal to sniff on it - if I'd need written permission from every single customer of our ISP before being allowed to run tcpdump or wireshark to debug a problem I'd never get anything done.
– Shadur
Mar 28 '11 at 11:20
Sorry, I wasn't clear enough, my bad. I meant it is illegal if he wants to capture live http sessions and steal cookies or passwords. I can't see any other use for this setup, or he'd probably need a proxy server.
– forcefsck
Mar 28 '11 at 11:30
Sorry, I wasn't clear enough, my bad. I meant it is illegal if he wants to capture live http sessions and steal cookies or passwords. I can't see any other use for this setup, or he'd probably need a proxy server.
– forcefsck
Mar 28 '11 at 11:30
add a comment |
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f10206%2fsniffing-packets-through-router%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
What's the OS on the router? If it's not a unix, we can't help you with that part.
– Gilles
Mar 28 '11 at 20:15
I don't know what the os is on the router, it is a fairly simple drink home router.
– giodamelio
Mar 28 '11 at 20:32
There's a point where you'll want to duplicate the packets (one copy for the sniffer and one copy to go to the modem). According to Howto: Copy/Tee/Clone network traffic using iptables by bjou, found from Copying packets from an interface to another, on Linux, this currently requires an additional kernel module.
– Gilles
Mar 28 '11 at 20:39