2

Is there any PC-based router/shaper/gateway that supports traffic capture / traffic analysis?

i maintain an Internet gateway, and want to run all traffic through a PC (virtual or otherwise), and have it log packets (e.g. rolling 5 TB logs). i know many routers support capturing of n packets (e.g. n=10000), then letting me download them in winpcap or WireShark format. But i'd like something more robust; designed to log desired packets on an ongoing basis.

Is there any (free) system that supports traffic capture, and (as a bonus) analysis.

It would be even better if this software supported traffic shaping of IPv4/6 traffic, with deep packet inspection, protocol violations, fragmentation, etc.

Why?

  • work at a company and need to monitor all Internet traffic for employees leaking company secrets
  • am a parent, and want to monitor my children's Internet activity
  • am a brick-and-mortar business that provides free WiFi and need to monitor Internet traffic for illegal activity
  • work for the NSA, and need to capture all traffic so i can later look for potential terrorists
  • i'm having intermittent MTU issues related to IPv6 traffic, and would like to reassemble traffic after the fact

i know i could install WireShark on my PC, and capture traffic that way. But i want to capture all traffic from all devices (e.g. iPods, iPads, Blackberrys, Nexii, e-readers, PlayStations, X-Boxes), from a central point, on a large server.

The server would either become everyone's default gateway, before it is passed onto the "real" router. Or the server would be the on the WAN side of the router, physically sending packets out the modem.

Pictures

Pictures are pretty. Everyone loves pictures. i currently have a PC-based router that does DHCP, DNS, traffic shaping, and is the gateway to the Internet:

enter image description here

What i need is some appliance that can be the new default gateway, and perform all the desired monitoring:

enter image description here

Bonus Reading

1 Answer 1

0

Install Linux on a PC with two network cards.

Linux can do:

  • routing/NAT
  • firewalling/filtering, including filtering on bad protocols and doing a lot of things on incoming, routed, and outgoing traffic.
  • traffic logging, i.e. Netflow (look into nfsen)
  • packet capture (install Wireshark or its command line equivalent, tshark, or look into OpenCALEA)
  • QoS (tc command)
  • transparent bridging
  • VPNs

None of the the above is trivial, especially the QoS part, but it's possible.

Not the answer you're looking for? Browse other questions tagged .