Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I want to mirror all traffic (also VPN, WLAN, WAN) from a consumer router (TPLink WR1043ND v.1.x) to a snort sensor located in the same network, but without extra hardware! The mirroring has to be done by the router (running OpenWrt Barrier Breaker).

Mirroring the WAN port of the router would even be supported by the current firmware, but the data of this stream is useless to me, because it does not contain the internal IPs of the devices connected to the router! I want the mirrored traffic from inside the router, with all internal IPs.

So, I quickly thought about tcpdump -i any. But to my knowledge it is not possible to configure 'tcpdump' to stream the mirrored traffic directly to the snort sensor? (without generating and saving enormous pcap-files to the harddrive)?

How do I solve this?


Edit: This Question is NOT answered!

Appendix: Would this work with using iptables --tee option mirroring all traffic? I think I would need to install this 'TEE iptables extensions' ipkg or this 'Kernel modules for TEE' ipkg from the OpenWRT repository in order to work? Would this work or do I need something else?

share|improve this question

migrated from serverfault.com May 18 at 4:56

This question came from our site for professional system and network administrators.

1  
This is a good question, and I'm curious to hear any answers. I've voted to have it moved to Superuser, though, as they're more experienced with consumer gear and alternate firmware like OpenWRT. –  EEAA May 17 at 2:52

2 Answers 2

up vote 2 down vote accepted

Yes iptables TEE works. I have a tplink router and I am mirroring the traffic exactly for the same reason as you.

Install all the necessary modules and packages for TEE.

Assuming your laptop's IP address is "10.1.1.205", run:

iptables -A POSTROUTING -t mangle -o br-lan ! -s 10.1.1.205 -j TEE --gateway 10.1.1.205

iptables -A PREROUTING -t mangle -i br-lan ! -d 10.1.1.205 -j TEE --gateway 10.1.1.205

share|improve this answer

A patch for OpenWrt to enable port mirroring on your hardware is available, though it has received only limited testing. You can, of course, apply and test it yourself.

share|improve this answer
    
I refered to this feature in my question. The problem is when mirroring the WAN port - you only get the public router IP and IP of the destination server. But I want the internal IPs of the clients and their exact connections to feed the snort sensor with. –  user3200534 May 17 at 3:32
    
If you want to mirror a different port, then you need to select that port! –  Michael Hampton May 17 at 3:38
    
Yes, you can choose between 1-4 LAN slots (ports). No WLan! No VPN! Only eth-ports at backside of the device or port 0 (= WAN). That is very far from all traffic of the router. –  user3200534 May 17 at 3:44
    
Hmm. I don't think you can mirror all traffic. This is, after all, a function of the hardware switch. So you won't get WLAN traffic, for instance, or traffic on virtual interfaces. Someone else in a similar situation may find this useful, though. –  Michael Hampton May 17 at 7:09

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.