Log all http and https traffic that goes to the router in OSX

Question

My router has ip 192.168.0.1.
How can I log all the traffic it receives under http and https(port 443)?
I think using tcpdump should do the trick but I'm not sure how to run it

Answer 1

First, you need to get the ethernet hardware address of the router (because traffic sent through it can be recognized by being sent to this link layer address):

$ arp -n 192.168.0.1
? (192.168.0.1) at 0:12:34:56:78:9a on en0 ifscope [ethernet]

Then use this address to tell tcpdump what to look for:

sudo tcpdump 'ether host 0:12:34:56:78:9a and not host 192.168.0.1 and (port http or https)'

Note that the quotes are needed to keep the shell from tripping over the parentheses. Also, if you leave out the and not host 192.168.0.1 part, it'll include traffic to the router (i.e. it would show you opening the router's web-based config interface) as well as through it. Finally, if you happened to have a DNS or /etc/hosts name defined for 192.168.0.1, you could use tcpdump's gateway primitive (sudo tcpdump 'gateway somename and (port http or https)'), but that doesn't work with IP addresses.

Edit: this will only report traffic going through the computer it's running on -- usually just traffic to/from that one computer. If you want to see traffic through the router from all hosts on the local lan, you need to set up some mechanism to have all of those packets sent to your capture computer. The WireShark documentation has a good discussion of the options for this.