I would like to temporarily monitor/log/analyze what traffic is going in and out of my home. I would also like to keep my current router configuration unchanged. The router is a WiFi Home Router, so I can't easily hack it. So I'm thinking of the following setup:
- "snip" the Ethernet cable between home router and broadband modem
- "insert" a Linux box with two Ethernet cards, one of which connects to the broadband modem, and one to the home router.
If I set up the two Ethernet cards as a bridge, how could I monitor/log/analyze all traffic that goes over it?
If I set it up as a router, is it possible to assign the same IP address to both Ethernet cards (the one I got from my broadband provider), and have traffic that comes in one eth0 get sent out on eth1, and vice versa? How would I monitor/log/analyze in that configuration?
I'm interested in things such as:
- which IP addresses does my house talk to (i.e. all devices in my house in aggregate), and how much traffic goes there?
- when does which traffic happen?
- what ports are being used?
- I have some "hermetically sealed" internet appliances in my house (e.g. a WiFi scale, AppleTV etc.). If I catch them doing something I don't want them to do -- like send data to an IP address I don't like -- can I use this configuration to "patch" their network traffic, e.g. drop those packets or re-route them to some other box that I control. Ideally I could do that on the level of DNS (e.g. by routing some DNS queries to a local DNS server) and on an IP level.
Of course I could set up NAT on the box, but that creates overhead and changes my network configuration. Who knows whether stuff like UPnP etc still works if there are two NATs in a row. I know how to do what I want to do with NAT, but I was hoping there was a more clever way that somebody could point out to me.
(This was moved from serverfault.com)