If you are like me, you already spent a few hours installing, testing features and configuring your OpenWRT Router to fit your exact needs, but what’s next?

Monitoring your network traffic is always a good idea, especially if you recently configured a new device in your network or installed a new application, and you don’t feel 100% comfortable with the communications that are going on behind the scenes ( some may argue why did you buy it in the first place 🙂 ).

Most of the network communication nowadays use some kind of encryption, and that makes it almost impossible to see exactly what’s being transmitted, even in your home network. There are tools that will allow you to decrypt some of these communications, but I won’t go over the details of decrypting network communication in this article.

Network traffic routing

A modern home router is more like a switch and a router in one single device. The traffic is normally routed directly to the port with the client that is supposed to receive that traffic.

Older switches used to send all network packets to every client in the network, and the clients were responsable for discarding packets that were not directed to them. Here’s where the concept of “promiscuous” in network communications is introduced. What “promiscuous” basically means is that when you enable that feature on a network adapter, your network adapter won’t discard any packets, even if those packets are not directed to you, it will accept all packages, allowing you to examine the packets with the right tools if you like.

Considering how network traffic is routed in modern devices, my main concern was, How am I going to redirect some other device’s network traffic to my PC? Or as a last resource, how can I dump and collect that information?

That’s where iptables and the module TEE come to the rescue. These 2 components will allow you to configure the router to basically clone some other device’s network traffic and send the copy to you, that will make your life easier since you won’t have to connect to the router to download any files.

Package and module installation on OpenWRT

1. Login to your OpenWRT Router, update your packages list and install iptables-mod-tee:

opkg update && opkg install iptables-mod-tee

2. Now let’s make sure the module has been loaded:

modprobe xt_TEE

You should get “xt_TEE is already loaded”.

3. Once all packages and their dependencies have been properly installed and initialized, setup the following iptables rules. Make sure you replace <target_device_ip> with the IP of the device you want to monitor and <my_machine_ip> with the IP of the device you will use to run Wireshark.

iptables -A PREROUTING -t mangle -i br-lan ! -d <target_device_ip> -j TEE --gateway <my_machine_ip>
iptables -A POSTROUTING -t mangle -o br-lan ! -s <target_device_ip> -j TEE --gateway <my_machine_ip>

Monitoring the network traffic in Wireshark

Now all we have to do is open Wireshark, select the interface we have connected to the router, apply a simple IP filter for our <target_device_ip> (i.e. ip.addr==192.168.1.20) and click on Capture:

Stop the network monitoring

In order to stop the network traffic capturing in Wireshark, all you got to do is click on the “Stop” icon of the toolbar.

If you would also like to stop the cloning of network packets and sending those packets to your PC, you will have to get the number of the rules you just created and remove them from the Mangle table.

1. List all rules in the Mangle table:

iptables -t mangle -L -n --line-number

Write down the rule numbers assigned to the rules you just created. You should have at least 2 rules, one for the “PREROUTING” chain and one for the “POSTROUTING” chain.

2. Delete the PREROUTING and POSTROUTING rules. Make sure you use the correct numbers! In my case the rule number was 1 (one) for both chains, but in your case both numbers may be different.

iptables -t mangle -D PREROUTING <prerouting_rule_number>
iptables -t mangle -D POSTROUTING <postrouting_rule_number>

Your router should now stop sending the other device’s packets out to your PC. In a router with very limited resources, this is certainly a step you always want to take once you are done with the monitoring.

Hope you found this article useful. If you have an easier method please let me know in the comments below.