{"id":3355,"date":"2016-03-11T04:14:18","date_gmt":"2016-03-11T04:14:18","guid":{"rendered":"http:\/\/www.garysieling.com\/blog\/?p=3355"},"modified":"2020-03-30T02:43:00","modified_gmt":"2020-03-30T02:43:00","slug":"simple-network-traffic-monitoring","status":"publish","type":"post","link":"https:\/\/www.garysieling.com\/blog\/simple-network-traffic-monitoring\/","title":{"rendered":"Simple TCP Traffic Monitoring"},"content":{"rendered":"

Let’s say you want to monitor devices on your network to see who sends unencrypted traffic – for instance, devices like a Nest or Withings scale.<\/p>\n

The simplest way to do this is to run a Wireless router that uses DD-WRT.<\/p>\n

First, enable Telnet:<\/p>\n

\"\"<\/p>\n

Then reboot the router:<\/p>\n

\"\"<\/p>\n

You should then be able to telnet into the router:<\/p>\n

telnet 192.168.11.1\n<\/pre>\n
The username will be “root” and the password will be what you chose above.<\/p>\n
From DD-WRT, find the list of connected devices – you’ll want to identify the hostname of the address you want to watch:<\/p>\n
\"\"<\/p>\n
Then from your telnet session you can show the output of that devices network data:<\/p>\n
tcpdump -l | grep android-21d3\n<\/pre>\n
This will then let you see the network traffic:<\/p>\n
05:08:30.914035 IP ec2-52-72-46-195.compute-1.amazonaws.com.www > android-21d3bd\n787d11c058.home.34768: Flags [F.], seq 2005764907, ack 3884437729, win 136, opti\nons [nop,nop,TS val 265231201 ecr 8506691], length 0\n05:08:30.954946 IP android-21d3bd787d11c058.home.34768 > ec2-52-72-46-195.comput\ne-1.amazonaws.com.www: Flags [.], ack 1, win 505, options [nop,nop,TS val 851235\n6 ecr 265231201], length 0\n05:08:32.108698 IP ec2-107-23-112-131.compute-1.amazonaws.com.https > android-21\nd3bd787d11c058.home.46161: Flags [P.], seq 199715238:199715269, ack 970139927, w\nin 82, options [nop,nop,TS val 2184533249 ecr 8506780], length 31\n<\/pre>\n
Remember that this is also just raw TCP output, so to really use this, you’ll want to go further to reconstruct HTTP traffic<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"
Let’s say you want to monitor devices on your network to see who sends unencrypted traffic – for instance, devices like a Nest or Withings scale. The simplest way to do this is to run a Wireless router that uses DD-WRT. First, enable Telnet: Then reboot the router: You should then be able to telnet … <\/p>\n
Continue reading “Simple TCP Traffic Monitoring”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[4,8],"tags":[278,381,539],"aioseo_notices":[],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/www.garysieling.com\/blog\/wp-json\/wp\/v2\/posts\/3355"}],"collection":[{"href":"https:\/\/www.garysieling.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.garysieling.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.garysieling.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.garysieling.com\/blog\/wp-json\/wp\/v2\/comments?post=3355"}],"version-history":[{"count":1,"href":"https:\/\/www.garysieling.com\/blog\/wp-json\/wp\/v2\/posts\/3355\/revisions"}],"predecessor-version":[{"id":6469,"href":"https:\/\/www.garysieling.com\/blog\/wp-json\/wp\/v2\/posts\/3355\/revisions\/6469"}],"wp:attachment":[{"href":"https:\/\/www.garysieling.com\/blog\/wp-json\/wp\/v2\/media?parent=3355"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.garysieling.com\/blog\/wp-json\/wp\/v2\/categories?post=3355"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.garysieling.com\/blog\/wp-json\/wp\/v2\/tags?post=3355"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}