Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have root access to my dd-wrt router at and computer at

I need to get the traffic comming through the router(in the Internet and out) from some other computer( and examine it in let's say wireshark on my machine. How can this be done? Probably using iptables on router.

share|improve this question
up vote 3 down vote accepted

From the machine where you want to run wireshark:

 ssh root@ddwrt tcpdump -i eth0 -w - host | wireshark -i -
share|improve this answer
@JohannaJames note that this will not store any data on the router but tunnel it through SSH to your local station's Wireshark for immediate examination. It might be worth enabling compression for SSH by supplying the -C parameter if the router is only reachable over a WAN. – the-wabbit Apr 29 '13 at 8:42
Thanks, very elegant solution. – Johanna James May 1 '13 at 18:15

You can install TCPdump on DD-WRT router to record a plan file that you can analyze later with WireShark.

share|improve this answer
Thanks for reply, but I need to do this in realtime +router doesn't have enough memory/disk space. – Johanna James Apr 27 '13 at 18:04
You can use a pcap filter an limit to what is important. – Mircea Vutcovici Apr 27 '13 at 19:41
take a look on ngrep too. – Mircea Vutcovici Apr 28 '13 at 0:38

the iptables TEE target can replicate packets to a given nexthop, this will do what you need.

share|improve this answer
The TEE target is even already available with DD-WRT out-of-the box:… But obviously, the traffic is not going to be routed through the internet so the TEE destination needs to be a network-local Wireshark station or at least be capable of tunneling the packets to the Wireshark station. – the-wabbit Apr 29 '13 at 8:44

You may also try iptables -d -t LOG. I'm not sure if dd-wrt iptables compiled with LOG support, so it might not work.

Please also note: your poor router will probably die on logging if there are too many traffic going to

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.