Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have just bought my own Raspberry Pi, and I want to log all networking traffic on an Ethernet cable by using the internal network card and an USB network card

I have tried by using

brctl addbr br0 
brctl addif br0 eth0
brctl addif br0 eth1
ifconfig br0 up

But it does not work as I want it to use it as an anonymous bridge, so all MACs and so on is send directly to the router, so it does not know about the network sniffer
But how do I do that?

I would also like to log it to a file instead of using Wireshark, but does anybody know about such program?

UPDATE

I figured it out. The ISP's box was taking very long time to gain signal, so I did not wait for too long before now
I also figured out, I could use ifconfig eth0 0.0.0.0 to unset the IP address on the network card

share|improve this question
    
I believe Wireshark is exactly what you want... I'm fairly certain you can operate it via the command line, and dump packet logs to files. –  Breakthrough Mar 14 '13 at 19:22
    
How doesn't it work? I've done the exact same thing several times (bridged two network cards), it worked perfectly. If you don't assign any IP addresses to your interfaces (br0, eth0, eth1), but make sure they're all up, your system will act exactly like a hardware switch. –  Ambroz Bizjak Mar 14 '13 at 19:26
    
I am trying to log the traffic to my ISP's IP-TV box, but it keeps saying, that the signal is disconnected, that is all I can say as the box does not give me any further information –  The87Boy Mar 14 '13 at 19:29
    
You should verify your setup by hooking up a PC to your LAN over your bridge. –  Ambroz Bizjak Mar 14 '13 at 19:31
    
Also be sure to check if both network cards indicate that the link is up, using "ip link show" and making sure both eth0 and eth1 have the RUNNING flag. If one doesn't, it's most likely that you need to use a reversed cable (straight/crossover) because neither of the two network cards on the link support auto detection. –  Ambroz Bizjak Mar 14 '13 at 19:33

2 Answers 2

up vote 1 down vote accepted

Copied from OP edit:

The ISP's box was taking very long time to gain signal, so I did not wait for too long before now

I also figured out, I could use ifconfig eth0 0.0.0.0 to unset the IP address on the network card

share|improve this answer
1  
He probably forgot to turn STP off. This is a symptom. –  David Schwartz Mar 15 '13 at 10:57
    
@DavidSchwartz at least an all systems I've tried brctl, STP was off by default, but the bridge does indeed need a few seconds to start forwarding after a link is established on one of the ports. –  Ambroz Bizjak Mar 15 '13 at 12:23

As the comment said, you can use wireshark. However tcpdump will also do this, and it is probably built into the OS.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.