Capturing Inbound/Outbound Traffic on Two Interfaces using tcpdump on an ASUS RT-AC66U Router
The ASUS RT-AC66U router is a popular choice for many home and small business networks. It offers a range of features, including the ability to capture network traffic using the tcpdump tool. This article will provide a detailed guide on how to capture inbound and outbound traffic on two interfaces using tcpdump on an ASUS RT-AC66U router.
Prerequisites
Before we begin, it is assumed that the reader has a basic understanding of networking concepts and has access to an ASUS RT-AC66U router with the stock firmware installed. The router should be configured in router mode and connected to the internet via a PPP connection with the Internet Service Provider (ISP).
Introduction to tcpdump
tcpdump is a powerful command-line tool that is used to capture and analyze network traffic. It is available on many operating systems, including Linux, macOS, and Windows. tcpdump can be used to capture traffic on a specific interface, filter traffic based on various criteria, and save the captured traffic to a file for later analysis.
Capturing Traffic on Two Interfaces
To capture traffic on two interfaces using tcpdump on an ASUS RT-AC66U router, we need to first identify the names of the interfaces. This can be done by running the following command:
# nvram show | grep port
size: 28522 bytes (27962 left)
eth0_ifname=eth0
eth1_ifname=eth1
eth2_ifname=eth2
eth3_ifname=eth3
eth4_ifname=eth4
eth5_ifname=eth5
eth6_ifname=eth6
wan0_ifname=vlan2
wan1_ifname=vlan3
wan_ifname=vlan2
lan_ifname=vlan1
In this example, we can see that the WAN interface is named vlan2 (wan0\_ifname=vlan2) and the LAN interface is named vlan1 (lan\_ifname=vlan1).
To capture traffic on both interfaces simultaneously, we can use the following command:
# tcpdump -i vlan2 -w /tmp/wan.pcap & tcpdump -i vlan1 -w /tmp/lan.pcap
This command will start tcpdump on both interfaces (vlan2 and vlan1) and save the captured traffic to two separate files (/tmp/wan.pcap and /tmp/lan.pcap). The -w option is used to specify the output file. The & symbol is used to run the two commands in the background simultaneously.
Filtering Traffic
By default, tcpdump captures all traffic on the specified interface. However, it is often useful to filter the captured traffic based on specific criteria. For example, we may only be interested in capturing HTTP traffic.
To filter traffic based on a specific criteria, we can use the -f option followed by a filter expression. For example, the following command will capture only HTTP traffic on the WAN interface:
# tcpdump -i vlan2 -f 'tcp port 80' -w /tmp/wan.pcap
In this example, the filter expression 'tcp port 80' is used to capture only TCP traffic on port 80 (HTTP).
- The ASUS RT-AC66U router stock firmware supports tcpdump for network traffic capture.
- To capture traffic on two interfaces, we need to identify the names of the interfaces using the nvram show command.
- To capture traffic on both interfaces simultaneously, we can use the tcpdump -i interface -w output\_file command for each interface.
- To filter traffic based on specific criteria, we can use the -f option followed by a filter expression.