Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

My router has ip 192.168.0.1.
How can I log all the traffic it receives under http and https(port 443)?
I think using tcpdump should do the trick but I'm not sure how to run it

share|improve this question

migrated from serverfault.com Jul 24 '11 at 14:44

This question came from our site for professional system and network administrators.

    
That depends a lot on the router. What kind is it? –  SysAdmin1138 Jul 24 '11 at 14:20
    
You are not giving us enough information. Is the router your Mac box? A dedicated router? If yes, what kind? Are there other stations in the network that might send data via the router? –  SvW Jul 24 '11 at 14:20
    
the router is a D-Link DIR-615 . I'd like to log all the PCs traffic to it –  al nik Jul 25 '11 at 17:39

1 Answer 1

First, you need to get the ethernet hardware address of the router (because traffic sent through it can be recognized by being sent to this link layer address):

$ arp -n 192.168.0.1
? (192.168.0.1) at 0:12:34:56:78:9a on en0 ifscope [ethernet]

Then use this address to tell tcpdump what to look for:

sudo tcpdump 'ether host 0:12:34:56:78:9a and not host 192.168.0.1 and (port http or https)'

Note that the quotes are needed to keep the shell from tripping over the parentheses. Also, if you leave out the and not host 192.168.0.1 part, it'll include traffic to the router (i.e. it would show you opening the router's web-based config interface) as well as through it. Finally, if you happened to have a DNS or /etc/hosts name defined for 192.168.0.1, you could use tcpdump's gateway primitive (sudo tcpdump 'gateway somename and (port http or https)'), but that doesn't work with IP addresses.

Edit: this will only report traffic going through the computer it's running on -- usually just traffic to/from that one computer. If you want to see traffic through the router from all hosts on the local lan, you need to set up some mechanism to have all of those packets sent to your capture computer. The WireShark documentation has a good discussion of the options for this.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.