A while back I saw IppSec performing a remote packet capture using tcpdump and pipeing it to wireshark for live analysis. I thought that could be useful to do on a home router and save the packets to a raspberry pi on the same LAN for later analysis. There are 2 reasons why I wanted to save the packets remotely:
- if the pcap file grows too big, the router may not have enough space to handle it and it may stop recording, it may reboot or even brick
- if the ISP pushes an update and the router is rebooted, I may loose the capture file, or even the access to the router; bonus I can see what the update is about
The setup is straight-forward but I couldn’t find an exact answer for it. I needed to be able to send and listen for this packets on multiple interfaces, with multiple capture rules, while in the background, indefinite amount of time and without having to stop the capture to be able to analyze the results.
1. RaspberryPi
On the raspberry pi, open a new screen and start a nc listener to an arbitrary port (4444 for example) and then detach the screen. Create as many screen listeners for each pcap file that needs to be recorded.
pi@raspberrypi:~ $ screen pi@raspberrypi:~ $ nc -l -v -p 4444 > /home/pi/router_traffic/ISP pi@raspberrypi:~ $ ctrl + a + d pi@raspberrypi:~ $ screen pi@raspberrypi:~ $ nc -l -v -p 4445 > /home/pi/router_traffic/WAN_cleartext pi@raspberrypi:~ $ ctrl + a + d
Once done, we can check all the active listeners
pi@raspberrypi:~ $ ps aux | grep nc root 65 0.0 0.0 0 0 ? S< Apr10 0:00 [vchiq-sync/0] systemd+ 299 0.0 0.5 22368 5488 ? Ssl Apr10 0:07 /lib/systemd/systemd-timesyncd pi 2963 0.0 0.0 7348 484 pts/0 S+ 13:02 0:00 grep --color=auto nc pi 4032 0.0 0.0 2704 612 pts/1 S+ Apr10 1:06 nc -lvnp 4444 pi 4221 0.0 0.0 2704 620 pts/2 S+ Apr10 0:16 nc -lvnp 4445
2. Router
On the router, we echo the tcpdump command in a temporary file and start it in the background. We pipe the tcpdump packets to nc, which sends them to the raspberry pi (192.168.0.73) on previously opened port
bash-3.2# cd /tmp bash-3.2# echo "tcpdump -l -nn -i privbr -U -w - | /tmp/tools/nc -vv -n 192.168.0.73 4444" > dump_isp.sh bash-3.2# bash dump_isp.sh & bash-3.2# cd /tmp bash-3.2# echo "tcpdump -l -nn -i wanbridge -U -w - port '(80 or 53)' | /tmp/tools/nc -vv -n 192.168.0.73 4445" > dump_cleartext.sh bash-3.2# bash dump_cleartext.sh &
Once done, we can check all active tcpdump sessions running
bash-3.2# ps ax| grep tcpdump Unknown HZ value! (94) Assume 100. 17296 ? S 4:28 tcpdump -l -nn -i wanbridge -U -w - port (80 or 53) 18140 ? S 3:56 tcpdump -l -nn -i privbr -U -w -
3. Wireshark
Now, at any moment in time we can open the pcap files from the Raspberry Pi in Wireshark and analyze the traffic up until that moment. This has the advantage that can run indefinite, and it does not require maintenance at all (unless the router is rebooted, in which case the tcpdump processes are killed).
Here we can see some SNMP (management protocol) traffic between ISP and the router.
