Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Today I got an enterprise Internet connection together with a Sagemcom router. The first time it is connected to the Internet, it will spend 20 minutes upgrading the firmware.

I would really like to capture all the traffic for this upgrade using a CentOS host with two NIC's, with the purpose to figure how upgrades are authenticated. E.g. with a secret user account and passphrase?

If I want to put the CentOS host between the Internet connection and the router:


  • How do I configure CentOS, so all traffic going in at eth0 goes out at eth1?
  • Is tcpdump -s0 -A -w upgrade.pcap -nni eth0 correct, if I want to use Wireshark later on to inspect the packages?
share|improve this question
up vote 4 down vote accepted

You could setup eth0 and eth1 as bridge and assuming eth0 is connected to the Sagemcom and eth1 is connected to the internet connection. The traffic would pass through the bridge, then you could run a TCP dump on the bridge and capture all of the traffic.

You will need the bridge-utils package

brctl addbr br0
brctl addif br0 eth0
brctl addif br0 eth1
ifconfig br0 up

tcpdump -s0 -w dump.pcap -i br0
share|improve this answer
Shall I give eth0 and eth1 static IP addresses e.g. and – Sandra Apr 5 '13 at 11:22
You may alo want to take a look at tcpreplay ( for some fun with replaying that captured traffic. – Aaron Bush Apr 5 '13 at 12:34
eth0 and eth1 don't need an ip address, if you need an IP so you can manage it remotely then you can add an IP to the bridge interface – Epaphus Apr 5 '13 at 16:13

First you'd set your CentOS box up as a router, which basically involves enabling packet forwarding (usually a machine is the destination), if you want to let traffic pass through.

The simple part of that is changing /etc/sysctl.conf.

net.ipv4.ip_forward = 0 to 1.

Then you'd set eth0 in one network, eth1 in the other, and add a route between the networks.

Configuring other things like firewalls or selinux is up to you.

I'd use tcpdump -s0 -n host < router IP > -w upgrade.pcap -i any
Though some of that might be redundant, for example, if you're listening for traffic going to and from the router IP, you shouldn't need to specify much in the way of interfaces, I believe.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.