Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have root access to my dd-wrt router at 192.168.0.1 and computer at 192.168.0.100.

I need to get the traffic comming through the router(in the Internet and out) from some other computer(192.168.0.101) and examine it in let's say wireshark on my 192.168.0.100 machine. How can this be done? Probably using iptables on router.

share|improve this question

4 Answers 4

up vote 3 down vote accepted

From the machine where you want to run wireshark:

 ssh root@ddwrt tcpdump -i eth0 -w - host 192.168.0.101 | wireshark -i -
share|improve this answer
1  
@JohannaJames note that this will not store any data on the router but tunnel it through SSH to your local station's Wireshark for immediate examination. It might be worth enabling compression for SSH by supplying the -C parameter if the router is only reachable over a WAN. –  the-wabbit Apr 29 '13 at 8:42
    
Thanks, very elegant solution. –  Johanna James May 1 '13 at 18:15

You can install TCPdump on DD-WRT router to record a plan file that you can analyze later with WireShark.

share|improve this answer
    
Thanks for reply, but I need to do this in realtime +router doesn't have enough memory/disk space. –  Johanna James Apr 27 '13 at 18:04
    
You can use a pcap filter an limit to what is important. –  Mircea Vutcovici Apr 27 '13 at 19:41
    
take a look on ngrep too. –  Mircea Vutcovici Apr 28 '13 at 0:38

the iptables TEE target can replicate packets to a given nexthop, this will do what you need.

share|improve this answer
    
The TEE target is even already available with DD-WRT out-of-the box: thatexplainsalot.com/blog/2010/11/… But obviously, the traffic is not going to be routed through the internet so the TEE destination needs to be a network-local Wireshark station or at least be capable of tunneling the packets to the Wireshark station. –  the-wabbit Apr 29 '13 at 8:44

You may also try iptables -d 192.168.0.101 -t LOG. I'm not sure if dd-wrt iptables compiled with LOG support, so it might not work.

Please also note: your poor router will probably die on logging if there are too many traffic going to 192.168.0.101.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.