2

I want to use a D-Link ADSL2 router/modem ( DSL-2640B ) to sniff all network traffic (for a security audit. I don't have time to scan all machines there and I want to know if they are quiet or sending 10MB/s of sensitive data to some location ;) ).

There will be a net connection on LAN port 1 and a PC with a packet sniffer on port 2. I want it to copy (-tee) all packets from wlan to port 2 while allowing them to pass to port 1 (where the gateway will be).

Since this router is NOT supported by dd-wrt, my best option is openwrt. I also have a DIR-635, but I really don't want to flash it since the network relies on it at the moment. I also have a DSL-2740B, but it's the same as this one but with two antennas.

I know it is possible to make a sniffing environment like this with iptables with -tee. Is it possible to make the router treat LAN1 as a WAN instead of a DSL port? How? Is it possible on stock D-Link firmware?

Here is the list of available commands from SSH:

> help

?
help
logout
reboot
adsl
atm
brctl
cat
ethctl
ddns
df
dumpcfg
echo
ifconfig
kill
arp
defaultgateway
dhcpserver
dns
lan
passwd
ppp
remoteaccess
restoredefault
route
save
swversion
wan
ping
ps
pwd
rip
siproxd
snmp
sntp
syslog
sysinfo
tftp
wlctl
wlan
1
2

Connect some old HUB into a LAN port of the router and sniff all traffic with any Unix sniffer. =))

2
  • That should work, assuming you can find a hub. – Keltari Sep 14 '12 at 18:04
  • eBay should have plenty sold. =) – Alex G Sep 14 '12 at 18:06
1

In every case of consumer router hardware I've seen, the device only has two ports: LAN and WAN. The LAN port is part of a dumb switch that usually has around four ports.

Because of this, you can't direct anything on the internal network. The switch portion is unmanaged and the device has no control over switch traffic, only routed traffic.

1
  • That's how the manufacturer firmware normally configures it, yes, but many can use VLANs to separate out the different ports if you install dd-wrt/Tomato USB/etc. (at least the four Linksys ones I have can) – derobert Sep 14 '12 at 17:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy