Monitor router traffic from PC

Question

I want to monitor traffic on my home router, how to do this? I have a Huawei router. I have searched this question before asking here but most of the sites and blogs just mentioned hacking and other stuff.

I want to monitor all traffic on my home router which I have complete access to. And I don't want to use any paid software. A list of detailed steps will help me a lot because it's a bit confusing for me. I am using Windows as my operating system.

Answer 1

Another solution would be to install a passive or active Ethernet tap between your router and the modem or wall outlet it connects to. Dedicated devices are made for this purpose, or you could simply use a system (e.g. Raspberry Pi) and give it two Ethernet ports. Then, you could run whatever software you want on there and your router wouldn't even need to know it's there, if configured correctly.

Answer 2

First of all, you should understand WHY do you want to monitor traffic, and then you should understand WHAT do you want to monitor. There's no generic "traffic monitoring", it can vary greatly depending on the goal:

1. It is possible (theoretically) to dump all the traffic coming from the router and store it on some storage device. However, it will be literally impossible to go through all this traffic on your own. Moreover, I've never heard of any organizations who do 100% traffic monitoring - it is almost impossible to achieve. So that approach you can use just to investigate any discrepancies you might find using another means, and definitely not to "monitor". To achieve this, you'll most probably need a router with span port, as rightfully mentioned by @schroeder, and also a storage (quite a big one, probably hundreds of gigabytes for a traffic coming from one usual PC).
2. It is possible to monitor only connection information. To do that, you again need a router with either Netflow logging capability or just a journal of all connections. Again, the number of connections will most certain be tremendous and impossible to process online, you'll need some log monitoring tool like ELK stack to store and analyze the logs. It requires quite some time and effort to deploy and maintain, and again - I've never heard of anyone analyzing all the connections in real-time manually, as it's just too many of them.
3. It is possible to monitor source and destination hosts and URLs and compare them against a public list of "bad" domains and URLs (so-called "indicators of compromise", or IoCs). Such lists are provided by "threat intelligence feeds", there're plenty of them on the internet. If you see such connection coming from or towards such IoC, it might mean something fishy is going on your PC. This is an approach used in many organisations; however, you again need to store the logs somewhere, parse them, ingest them in log storage tool, and run comparison against that threat intelligence feed. You'll get for sure many false positives, and just investigating them, as well as maintaining feed integrity, can easily occupy you for several weeks. Not an easy task for sure.
4. You can also search for suspicious content in all traffic. This is usually done by so-called YARA rules, and the story is the same: get full copy, compare, process the results. A bit less false positives, but still a lot to do.
5. You can look for different traffic anomalies - for example, SQL injections/scannings etc. coming from or towards your PC. In corporations, advanced next-generation firewalls do that job nowadays; you can use Snort, an open source intrusion detection system (IDS) with some basic rules. Also, not an easy pick.
6. Finally, you can just dive into any of the above data, and try to find anomalies manually - this is called "threat hunting". For example, you might notice excessive amount of traffic towards some IP or domain, or suspicious ports opened on your PC. This, however, requires good infosec background, consumes unbelievably big amount of time, and usually yields very little results.

So, to sum everything up: to get some decent traffic monitoring, you'll most probably need to get a high-end enterprise router (or at least custom OS build for your SOHO-class router), a server with a lot of disk space, memory, and good CPU, and a team of professional system administrators and network analysts to cope with the task :)

Therefore, there's really little sense in planning such things at home. If you're interested what's happening on your PC, just install any packet sniffer like Wireshark, dump the traffic locally, and analyze - it would give you quite a decent picture. Make sure the firewall on your router is properly configured, your OS and installed software are always updated to the last version, you have a decent antivirus solution installed there, and you don't do any dumb actions like launching untrusted executable files. That should keep you safe enough that you'll never need to do full traffic monitoring.