I have a crazy stupid problem driving me to an early grave and I'm trying to trouble shoot what the problem is.

Is there a way to listen to all traffic going through my router, including dropped SYN packets and whatever else? I would imagine using Wireshark or tcpdump for this.

According to this post the answer is "no" (since my ASUS home router doesn't seem to have a traffic dump) but I thought I'd ask in any case.

  • What model ASUS? – davidgo Dec 20 '19 at 9:07
  • Also, are you worried about traffic traversing the router from man to wan or vice versa, or do you want to see what's happening on the individual land ports on the router? Are you willing and able to install dd-wrt? – davidgo Dec 20 '19 at 9:09
  • ASUS RT-AC51U. I'm an at-home amateur and only have basic knowledge of routing and the Internet protocol, I don't know what MAN or DD-WRT is. – Mossmyr Dec 20 '19 at 10:39
  • 1
    DD-WRT is replacement router firmware which includes tcpdump. Your model isn't supported.When I said MAN it was a typo, it should have been LAN. You should be able to install openwrt on your router which will give you the ability to use tcpdump, but if you are not comfortable on the Linux command line I would not necceddarily suggest it (I last used it many years ago and the GUI was optional. I think it still is, and it had a much steeper learning curve then dd-wrt) – davidgo Dec 20 '19 at 18:40

If your router doesn't support traffic mirroring/monitoring you could do it this way:

Get a network a switch that supports traffic mirroring/monitoring or get a network hub and plug it in between the router and the rest of your network. If using a switch you'll need to configure it accordingly for traffic mirroring/monitoring. If using a hub, no configuration is needed.

Install Wireshark (or whatever you like) on the computer you want to use for this Wireshark analysis. Note that with a switch you'll need to configure it to mirror the traffic transiting the switch TO the switch port that your Wireshark computer is connected to. This is why it's easier to use a hub rather than a switch. A hub by it's very nature will flood all frames to all ports, so your Wireshark machine will see all the traffic transiting the hub.

Start your Wireshark capture. Analyze the captured traffic. Enjoy!

Note that it's pretty hard to find network hubs these days. I don't know of any network equipment vendor that still makes or sells them, but you can probably find on one eBay for a few dollars.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.