Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I want to use a D-Link ADSL2 router/modem ( DSL-2640B ) to sniff all network traffic (for a security audit. I don't have time to scan all machines there and I want to know if they are quiet or sending 10MB/s of sensitive data to some location ;) ).

There will be a net connection on LAN port 1 and a PC with a packet sniffer on port 2. I want it to copy (-tee) all packets from wlan to port 2 while allowing them to pass to port 1 (where the gateway will be).

Since this router is NOT supported by dd-wrt, my best option is openwrt. I also have a DIR-635, but I really don't want to flash it since the network relies on it at the moment. I also have a DSL-2740B, but it's the same as this one but with two antennas.

I know it is possible to make a sniffing environment like this with iptables with -tee. Is it possible to make the router treat LAN1 as a WAN instead of a DSL port? How? Is it possible on stock D-Link firmware?

Here is the list of available commands from SSH:

> help

?
help
logout
reboot
adsl
atm
brctl
cat
ethctl
ddns
df
dumpcfg
echo
ifconfig
kill
arp
defaultgateway
dhcpserver
dns
lan
passwd
ppp
remoteaccess
restoredefault
route
save
swversion
wan
ping
ps
pwd
rip
siproxd
snmp
sntp
syslog
sysinfo
tftp
wlctl
wlan
share|improve this question
1  
If you know how to do it with iptables, it seems like you should just install iptables... wiki.openwrt.org/doc/howto/netfilter –  derobert Sep 14 '12 at 17:49
add comment

migrated from unix.stackexchange.com Sep 14 '12 at 17:09

This question came from our site for users of Linux, FreeBSD and other Un*x-like operating systems..

2 Answers

Connect some old HUB into a LAN port of the router and sniff all traffic with any Unix sniffer. =))

share|improve this answer
    
That should work, assuming you can find a hub. –  Keltari Sep 14 '12 at 18:04
    
eBay should have plenty sold. =) –  Radio Sep 14 '12 at 18:06
add comment

In every case of consumer router hardware I've seen, the device only has two ports: LAN and WAN. The LAN port is part of a dumb switch that usually has around four ports.

Because of this, you can't direct anything on the internal network. The switch portion is unmanaged and the device has no control over switch traffic, only routed traffic.

share|improve this answer
    
That's how the manufacturer firmware normally configures it, yes, but many can use VLANs to separate out the different ports if you install dd-wrt/Tomato USB/etc. (at least the four Linksys ones I have can) –  derobert Sep 14 '12 at 17:51
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.