Other OS

sniffing on ports with R1 and OpenWRT

5 3986
Humbala  
Using the OpenWRT image is it possible to sniff the traffic on any port?
Or are you limited to sniffing traffic from the WAN port and all ports on the switch?

What I would like to achieve is that I can sniff traffic per port (regardless of WAN or any switch port). It would even be nice to sniff traffic on port 1 with snort, traffic on port 2 with suricata, port 3 tcpdump etc... would this be possible?
Yes it would be possible.  Since you are acting as the router, its very possible to see the traffic going from the lan to the wan. I think snort should do i with no problem. However.. installing snort on openwrt is a pain, actually installing anything on openwrt is a pain because of the read only filesystem thing it does. I dont know how to get around it. Ive been trying to use the openwrt images but i just cant install anything on them.

"SquashFS is a read only compressed filesystem. While gzip is available, at OpenWrt it uses LZMA for the compression. Since SquashFS is a read only filesystem, it doesn't need to align the data, allowing it to pack the files tighter thus taking up significantly less space than JFFS2 (20-30% savings over a JFFS2 filesystem)".


If you can find a way to install packages on the openwrt image, it would be amazing to share it. I tried to build snort from source..but because of the read only filesystem thing, i was unable to install gcc, g++, automake, etc. It made things impossible

mattrix  
Swap from OpenWRT to Bananian and then you are FREEEEEE!

Humbala  
Thanks Mattix, would you be able to provide me with an "interfaces" and "swconfig" that might work?
I have been trying to get it working in Bannanian as well but no luck so far. Is there a possibility to treat the switch as 4 different ETH's?
so we can say snort -i eth0/eth1/eth2 etc...?

mattrix  
Edited by mattrix at Fri Mar 6, 2015 15:13

Yes.

See here: http://forum.lemaker.org/forum.p ... 07&fromuid=2122
Then you would sniff eth0.101, eth0.102, eth0.103 etc etc

Humbala  
Hello mattirx, sorry for net getting back to you sooner, got caught up in too much work.
I have tested your config and seems to work, thank you!

I have an additional question though, is it possible to set up an IP address for each interface seperatly? I have done so and only port 3 "wan" seems to work correctly (pings, lookups etc...). The ports on the switch don't seem to accept the IP settings.

You have to log in before you can reply Login | Sign Up

Points Rules