I have root access to my dd-wrt router at and computer at

I need to get the traffic comming through the router(in the Internet and out) from some other computer( and examine it in let's say wireshark on my machine. How can this be done? Probably using iptables on router.


From the machine where you want to run wireshark:

 ssh root@ddwrt tcpdump -i eth0 -w - host | wireshark -i -
| improve this answer | |
  • 2
    @JohannaJames note that this will not store any data on the router but tunnel it through SSH to your local station's Wireshark for immediate examination. It might be worth enabling compression for SSH by supplying the -C parameter if the router is only reachable over a WAN. – the-wabbit Apr 29 '13 at 8:42

You can install tcpdump on DD-WRT router to record a pcap file that you can analyze later with WireShark. pcap is the file format used by tcpdump to do the capture the network traffic.

| improve this answer | |
  • Thanks for reply, but I need to do this in realtime +router doesn't have enough memory/disk space. – Johanna James Apr 27 '13 at 18:04
  • You can use a pcap filter an limit to what is important. – Mircea Vutcovici Apr 27 '13 at 19:41
  • take a look on ngrep too. – Mircea Vutcovici Apr 28 '13 at 0:38

the iptables TEE target can replicate packets to a given nexthop, this will do what you need.

| improve this answer | |
  • The TEE target is even already available with DD-WRT out-of-the box: thatexplainsalot.com/blog/2010/11/… But obviously, the traffic is not going to be routed through the internet so the TEE destination needs to be a network-local Wireshark station or at least be capable of tunneling the packets to the Wireshark station. – the-wabbit Apr 29 '13 at 8:44

You may also try iptables -d -t LOG. I'm not sure if dd-wrt iptables compiled with LOG support, so it might not work.

Please also note: your poor router will probably die on logging if there are too many traffic going to

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.