Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I would like to temporarily monitor/log/analyze what traffic is going in and out of my home. I would also like to keep my current router configuration unchanged. The router is a WiFi Home Router, so I can't easily hack it. So I'm thinking of the following setup:

  • "snip" the Ethernet cable between home router and broadband modem
  • "insert" a Linux box with two Ethernet cards, one of which connects to the broadband modem, and one to the home router.

If I set up the two Ethernet cards as a bridge, how could I monitor/log/analyze all traffic that goes over it?

If I set it up as a router, is it possible to assign the same IP address to both Ethernet cards (the one I got from my broadband provider), and have traffic that comes in one eth0 get sent out on eth1, and vice versa? How would I monitor/log/analyze in that configuration?

I'm interested in things such as:

  • which IP addresses does my house talk to (i.e. all devices in my house in aggregate), and how much traffic goes there?
  • when does which traffic happen?
  • what ports are being used?
  • I have some "hermetically sealed" internet appliances in my house (e.g. a WiFi scale, AppleTV etc.). If I catch them doing something I don't want them to do -- like send data to an IP address I don't like -- can I use this configuration to "patch" their network traffic, e.g. drop those packets or re-route them to some other box that I control. Ideally I could do that on the level of DNS (e.g. by routing some DNS queries to a local DNS server) and on an IP level.

Of course I could set up NAT on the box, but that creates overhead and changes my network configuration. Who knows whether stuff like UPnP etc still works if there are two NATs in a row. I know how to do what I want to do with NAT, but I was hoping there was a more clever way that somebody could point out to me.

(This was moved from serverfault.com)

share|improve this question

1 Answer 1

up vote 3 down vote accepted

Route between two network interfaces with same IP address?

This is a nonsensical statement. IP addresses must be unique in a network - TCP/IP relies on this fact to operate correctly.

However -

Transparently bridge between two network interfaces

sounds much more like what you are trying to do.

I believe Linux supports transparent bridging. Interfaces junctioned to a bridge will function like a switch. Of course you can sniff traffic going across the bridge with Wireshark or it's command line equivalent, tshark. I've never done it with physical NICs (usually it's 1 physical NIC and something like a virtual adapter for a VPN) - this is an experiment I've been wanting to do for a long time (an old box with 4 NICs - turning it into a software switcH) but it should work. brctl is the command you want to look into.

So, in the "middle" Linux box, you need to create a bridge, add your NICs to it, and that's it. The NICs are part of a bridge and don't receive individual IP addresses (much like ports on a switch). Like a switch it will forward traffic on layer 2, not layer 3, and the devices on either side won't know there's something in the middle.

iptables, the Linux interface to Netfilter, which is responsible for routing, packet filtering, and packet mangling (modification) is very versatile and you could probably do something equivalent with that, even though it works on Layer 3.

As far as software that can analyze your captured stream there are many tools to do that. It's not something I've been invovled with in depth but once you are able to capture packets with something like Wireshark a lot of options are open to you.

share|improve this answer
1  
Found a write-up that describes this nicely: linuxjournal.com/article/8172. –  Johannes Ernst Oct 25 '13 at 21:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.