Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My router has ip
How can I log all the traffic it receives under http and https(port 443)?
I think using tcpdump should do the trick but I'm not sure how to run it

share|improve this question

migrated from Jul 24 '11 at 14:44

This question came from our site for system and network administrators.

That depends a lot on the router. What kind is it? – SysAdmin1138 Jul 24 '11 at 14:20
You are not giving us enough information. Is the router your Mac box? A dedicated router? If yes, what kind? Are there other stations in the network that might send data via the router? – Sven Jul 24 '11 at 14:20
the router is a D-Link DIR-615 . I'd like to log all the PCs traffic to it – al nik Jul 25 '11 at 17:39

First, you need to get the ethernet hardware address of the router (because traffic sent through it can be recognized by being sent to this link layer address):

$ arp -n
? ( at 0:12:34:56:78:9a on en0 ifscope [ethernet]

Then use this address to tell tcpdump what to look for:

sudo tcpdump 'ether host 0:12:34:56:78:9a and not host and (port http or https)'

Note that the quotes are needed to keep the shell from tripping over the parentheses. Also, if you leave out the and not host part, it'll include traffic to the router (i.e. it would show you opening the router's web-based config interface) as well as through it. Finally, if you happened to have a DNS or /etc/hosts name defined for, you could use tcpdump's gateway primitive (sudo tcpdump 'gateway somename and (port http or https)'), but that doesn't work with IP addresses.

Edit: this will only report traffic going through the computer it's running on -- usually just traffic to/from that one computer. If you want to see traffic through the router from all hosts on the local lan, you need to set up some mechanism to have all of those packets sent to your capture computer. The WireShark documentation has a good discussion of the options for this.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .