My router has ip 192.168.0.1.
How can I log all the traffic it receives under http and https(port 443)?
I think using tcpdump should do the trick but I'm not sure how to run it
migrated from serverfault.com Jul 24 '11 at 14:44
First, you need to get the ethernet hardware address of the router (because traffic sent through it can be recognized by being sent to this link layer address):
Then use this address to tell tcpdump what to look for:
Note that the quotes are needed to keep the shell from tripping over the parentheses. Also, if you leave out the
Edit: this will only report traffic going through the computer it's running on -- usually just traffic to/from that one computer. If you want to see traffic through the router from all hosts on the local lan, you need to set up some mechanism to have all of those packets sent to your capture computer. The WireShark documentation has a good discussion of the options for this.