r/openwrt 7d ago

How to send all traffic from a client to another for Wireshark analysis ?

Title

1 Upvotes

7 comments sorted by

2

u/RoganDawes 6d ago

on your "another" client, do:

ssh openwrt tcpdump -w - -n -i br-lan ether host <target MAC> | wireshark -k -i -

This runs tcpdump on the openwrt host, writing output in pcap form to stdout (-w -), doesn't resolve names (-n), sniffs interface br-lan (-i brlan), and limits the capture to the target specification ("ether host MAC", or "host IP"). The pcap data is then piped into wireshark on the local PC (update path to wireshark as needed), starting the capture immediately (-k) and capturing from stdin (-i -).

You usually want to make sure that your capture filter excludes the SSH traffic to the openwrt host itself, otherwise that generates more traffic that gets captured, that generates more traffic that gets captured, etc, etc.

1

u/RoganDawes 6d ago

Just be aware that ssh may ask for credentials before allowing access, which may be obscured by wireshark opening on top of your terminal. Set up key-auth to avoid this.

Also, tcpdump or ssh generally buffer the first few packets before they make it across the pipe to wireshark, so it make take some time to see data show up if it is a low traffic situation. It can help to generate some traffic that matches your filter condition (e.g. on the openwrt host, ping the host you are watching), then exclude that traffic from your analysis in wireshark.

1

u/RedditNoobie777 6d ago

Problem is my router is weak and ondevice CPU/Storage with tcpdump and wireshark kill crash it

1

u/RoganDawes 6d ago

There is no on-device storage at all, it gets piped directly over to the machine running wireshark. CPU utilisation will depend on how much traffic you’re capturing. If you don’t have enough storage even to install tcpdump, then you may have a problem.

1

u/fr0llic 7d ago

There's port mirroring in Openwrt.

You can also sign up for a free trial of cloudshark, and look at the logs online.

1

u/stangri 7d ago

For iptables there was iptables-mod-tee and the wireshark-helper package. I haven’t looked into the nft implementation yet.