To capture inbound and outbound traffic on an ASUS RT-AC66U router running Merlin firmware, use the tcpdump utility via SSH. Select the specific interface (e.g., ppp0 for WAN or br0 for LAN) to isolate traffic direction. This method allows detailed inspection of packet flow without needing external network taps.
Accessing the Router via SSH
The first step is establishing a secure shell connection to your router. The ASUS RT-AC66U does not enable SSH by default in the stock firmware; you must install the Asuswrt-Merlin custom firmware to access advanced command-line tools like tcpdump. Once Merlin is installed, navigate to the Administration tab in the web GUI and enable SSH under the System section. Ensure that the SSH port is set to 22 or a custom port if required by your network policy.
Use an SSH client such as PuTTY on Windows or the terminal on macOS/Linux to connect. Enter the router’s IP address (usually 192.168.1.1) and your admin credentials. If you are using a non-standard port, specify it after the IP with a colon (e.g., 192.168.1.1:2222). Successful authentication grants you root-level access, which is necessary for running packet capture utilities.
Identifying Network Interfaces
Before capturing traffic, you must identify the correct network interfaces. In a typical PPPoE setup on the RT-AC66U, the WAN connection is handled by ppp0, while the local area network is bridged through br0. Other interfaces may include eth0 (physical Ethernet) or wlan0 (wireless), depending on your configuration.
Run the following command to list all active interfaces:
ifconfig -aLook for interfaces with IP addresses assigned. For inbound traffic from the internet, monitor ppp0. For outbound traffic to devices on your LAN, monitor br0. Note that some traffic may traverse multiple interfaces, so understanding your routing table is crucial. If you are unsure, you can check the routing table with route -n to see how packets are directed.
Capturing Inbound Traffic
Inbound traffic refers to packets arriving from the internet destined for your local network. To capture this, target the WAN interface. Use the tcpdump command with the -i flag to specify the interface and -w to write to a file for later analysis.
tcpdump -i ppp0 -w inbound.pcapThis command starts capturing packets on ppp0 and saves them to inbound.pcap. You can add filters to reduce noise. For example, to capture only HTTP traffic, use tcpdump -i ppp0 port 80 -w http_inbound.pcap. To stop the capture, press Ctrl+C in the SSH session. The resulting file can be transferred to your computer using SCP or SFTP for analysis with Wireshark.
Capturing Outbound Traffic
Outbound traffic consists of requests sent from your local devices to the internet. Monitor the LAN bridge interface br0 to see these packets before they are routed out. Similar to inbound captures, use the -i flag to select the interface.
tcpdump -i br0 -w outbound.pcapBe aware that capturing on br0 includes all local broadcast and multicast traffic, which may increase file size. To focus on specific protocols, apply filters. For instance, to capture DNS queries, use tcpdump -i br0 port 53 -w dns_outbound.pcap. This helps in diagnosing connectivity issues or monitoring data usage per protocol.
Analyzing Captured Data
Once captures are complete, transfer the .pcap files to your local machine. Tools like Wireshark provide a graphical interface to inspect packet details, including headers, payloads, and timing. Filter by IP address or protocol within Wireshark to isolate relevant conversations.
If you need to view traffic in real-time without saving, omit the -w flag. However, this generates large amounts of output quickly. For targeted debugging, combine tcpdump with grep or other text processing tools if you prefer command-line analysis. Remember that encrypted traffic (HTTPS) will show encrypted payloads, limiting visibility into content but still revealing metadata like destination IPs and ports.
For more insights on network diagnostics, consider reviewing Capture network traffic from physical devices in a Linux VM for alternative capture methods. Additionally, Using PC VPN client behind VPN router with ASUS AX5400 router and NordVPN on Windows devices offers context on handling complex routing scenarios.
Frequently Asked Questions
Why is my tcpdump capture empty?
An empty capture usually indicates incorrect interface selection or insufficient permissions. Ensure you are targeting the right interface (e.g., ppp0 vs br0) based on traffic direction. Also, verify that no firewall rules are dropping packets before they reach the interface being monitored.
Can I capture both inbound and outbound simultaneously?
Yes, but you need separate commands for each interface. Running two instances of tcpdump concurrently on different interfaces works fine. Save each to a distinct file to avoid confusion during analysis. Do not run two captures on the same interface expecting bidirectional logging, as this may cause conflicts.
How do I filter traffic by IP address?
Add a filter expression to the end of your tcpdump command. For example, tcpdump -i ppp0 host 192.168.1.100 captures only traffic involving that specific IP. This reduces file size and focuses analysis on relevant hosts, making troubleshooting more efficient.
Is tcpdump available on stock ASUS firmware?
No, standard ASUS firmware does not include tcpdump. You must install Asuswrt-Merlin or another custom firmware variant that supports additional utilities. Stock firmware limits users to basic status pages and logs, lacking raw packet access.
What are the risks of long-term packet capturing?
Prolonged captures consume significant CPU and storage resources on the router. This can degrade performance, especially on older models like the RT-AC66U. Limit capture duration to essential troubleshooting windows and delete old .pcap files regularly to maintain system stability.