Analyzing Network Traffic of an IoT Device connected to a DD-WRT Router
In this article, we will focus on analyzing network traffic of an Internet of Things (IoT) device that is connected to a DD-WRT router. We will use a Windows machine with Wireshark to capture and analyze the network packets. The specific IoT device we will be analyzing is an Espressif device with IP address 192.168.0.145.
Setting up the DD-WRT Router
Before we can begin analyzing network traffic, we need to ensure that our DD-WRT router is properly configured. Here are the steps to follow:
- Connect to the DD-WRT router's web interface by entering its IP address (192.168.0.1) into a web browser.
- Log in using your administrator credentials.
- Navigate to the
Servicestab and enable theSSHservice. - Save your changes and apply them.
Setting up Wireshark on the Windows Machine
Now that our DD-WRT router is configured, we need to set up Wireshark on our Windows machine. Here are the steps to follow:
- Download and install Wireshark from the official website.
- Launch Wireshark and select the network interface that is connected to the DD-WRT router.
- Set a filter to capture only traffic to and from the Espressif device (IP address 192.168.0.145).
- Start the capture.
Analyzing the Network Traffic
Once we have captured some network traffic, we can begin analyzing it. Here are some key concepts to keep in mind:
- Packets: Network traffic is composed of individual packets, which are small units of data that are sent between devices.
- Protocols: Packets use specific protocols, such as TCP/IP or UDP, to communicate with each other.
- Flags: Packets have flags that indicate their status, such as whether they are a request or a response.
- Payload: The payload of a packet is the actual data that it contains.
Here are some tips for analyzing network traffic:
- Look for patterns in the traffic. For example, are there a lot of requests being made to a particular IP address or port?
- Identify the protocols being used. This can help you understand how the devices are communicating.
- Examine the flags and payloads of individual packets to get a better understanding of the traffic.
Example Analysis
Let's take a look at an example of analyzing network traffic of an IoT device connected to a DD-WRT router.
00:11:22:33:44:55 > 66:77:88:99:AA:BB, Ethernet II, Length: 100
Destination: 66:77:88:99:AA:BB
Source: 00:11:22:33:44:55
Type: IP (0x0800)
0000 45 00 00 3c 8b 5a 66 77 88 99 aa bb 40 00 40 11
0010 7f 01 c0 a8 00 91 c0 a8 00 02 9b 6b 7f 00 00 01
0020 7f 00 00 01 50 18
IP Version: 4
Header Length: 20 bytes
Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
Total Length: 100
Identification: 0x003c (60)
Flags: 0x4000 (Don't Fragment)
Fragment Offset: 0
Time to Live: 127
Protocol: UDP (17)
Header Checksum: 0x4011
Source IP Address: 192.168.0.2
Destination IP Address: 192.168.0.145
In the above example, we can see that the source IP address is 192.168.0.2 (the Windows machine running Wireshark) and the destination IP address is 192.168.0.145 (the IoT device). The protocol is UDP (User Datagram Protocol), which is a connectionless protocol that is commonly used for IoT devices.
In this article, we have learned how to analyze the network traffic of an IoT device that is connected to a DD-WRT router using a Windows machine with Wireshark. By understanding the key concepts of packets, protocols, flags, and payloads, we can gain valuable insights into how our IoT devices are communicating on our home network. This can help us troubleshoot issues, improve security, and optimize performance.
References
- Books:
- Lauren, T. (2019). Wireshark Network Protocol Analyzer: The Comprehensive Guide.
- Kurose, J. F., & Ross, K. W. (2017). Computer Networking: A Top-Down Approach, 7th Edition.
- Articles:
- Chappell, M. (2020). Wireshark User's Guide: Packet Fundamentals.
- Williams, J. (2018). How to analyze IoT device traffic with Wireshark.
- Online Resources: