0

My goal is to be able to capture all packets on my home network. Every packet generated by a local machine or received from the Internet. (No, I'm not trying to spy on anyone. This is my home network and I wish to capture packets for my work in developing network monitoring software. Just trying to "eat my own dog food" as they say. And yes I understand the performance limitations of forcing all my traffic into a single port.)

But I'm unable to figure out how/where I can get access to all the packets. I do have an 8-port switch with port mirroring. I've tried this:

CableModem = Switch = WifiRouter = { Machines-On-My-Network }
               ||
        MonitoringMachine

Where Machines-On-My-Network are mostly wifi-only, but a couple are wired directly to the WifiRouter. This config works fine. However, obviously my monitoring machine only sees packets that are going from a machine in my internal network to the Internet or vice versa (with NAT'd addresses); I don't get internal-only traffic.

I've also tried this config:

CableModem = WiredRouter = Switch = WifiRouterInAccessPointMode = { Machines-On-My-Network }
                             ||
                      MonitoringMachine

This has DHCP enabled in the "wired router" (actually an older wifi router with its radio disabled) and DHCP disabled in the wifi router. I say "InAccessPointMode" here but my router config has no actual access point mode -- I just disabled DHCP -- is that different? But in any case the configuration did not work well. Most of my internal machines could get addresses via DHCP but a couple of wifi-enabled machines were not receiving DHCP offers for reasons I could not determine (wireshark on the monitoring machine showed DHCP offers being sent between the routers but on the end machine no DHCP offer was showing up on its wifi port). Also, the DHCP leases on other machines were not renewing automatically as I would expect, for no apparent reason. The whole thing was flaky and my SO complained about the network not working so I reverted.

But even had this worked more reliably, I believe I would still not have seen packets between wifi-enabled machines in my local network or those between wired ports on the wifi router. So I don't know if that's really much improvement over the first configuration. I'd just see internal-external traffic plus DHCP and internal broadcast traffic.

It had occurred to me that it might be possible to do something with OpenWRT or DD-WRT to mirror everything directly to a wired port on the wifi router, but I'm still not entirely sure I'd be able to get access to all the packets (I'm not really familiar with the internal architecture of wifi routers). Also I have no experience with OpenWRT/DD-WRT and don't have either installed right now, but I would be willing to go learn that if I thought I could achieve the desired result.

For what it's worth, I currently have all TP-Link network equipment with stock firmware (TC-7610 cable modem, TL-WDR3600 for the "wired" router, TL-SG108E mirroring switch and Archer C50 wifi router).

I'd even be willing to go buy another piece of equipment if necessary. But I cannot find any wifi router that claims to support mirroring of all traffic.

Is there any way to get access to all my local traffic?

  • Im surprised no one answered this. Can you draw a diagram of how you have this connected? I'm not familiar with the options of the switch you have, but this should be possible to do with what you have. I'll see what I can find in it's manual. – Tim_Stewart Mar 10 '18 at 19:14
  • Did you managed to find a way to monitor internal wifi traffic? – Michael Nov 27 '18 at 7:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.