Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 3 down vote favorite
1

I would like to create a system like this. enter image description here

The user would connect through a wifi network which would reroute all http requests and responses through the network card on a computer thus allowing that computer to sniff the packets. I have debian running on the computer. How would i go about doing this?

share|improve this question
What's the OS on the router? If it's not a unix, we can't help you with that part. – Gilles Mar 28 '11 at 20:15
I don't know what the os is on the router, it is a fairly simple drink home router. – giodamelio Mar 28 '11 at 20:32
There's a point where you'll want to duplicate the packets (one copy for the sniffer and one copy to go to the modem). According to Howto: Copy/Tee/Clone network traffic using iptables by bjou, found from Copying packets from an interface to another, on Linux, this currently requires an additional kernel module. – Gilles Mar 28 '11 at 20:39

4 Answers

up vote 2 down vote accepted

Get a 10/100 ethernet hub, a real hub, like a Netgear DS104. Put it between the wifi and the router. Hubs replicate traffic on all ports, so you can connect a separate machine to another port on the hub and sniff everything.

share|improve this answer
It seems that this will be the easiest way to do the job, thanks. – giodamelio Mar 28 '11 at 20:34
up vote 2 down vote

Unless your brand of router specifically allows for that kind of interception (most don't unless you're talking about industrial grade stuff with triple digit costs and usage licenses) I'm afraid you're sunk; a better bet might be to install a wifi card in your computer and try to sniff the wireless traffic directly using something like wireshark or Kismet.

share|improve this answer
I was thinking about getting a little creative with my hardware, What is I were to connect the Ethernet in on my router to my computer with a cat5 cable then use tshark to sniff the packets before redirecting all the data back to the ip of the modem. If that was confusing just tell me, ill draw up another diagram. – giodamelio Mar 28 '11 at 10:00
here is a pic gyazo.com/45210b1932d7140cdc160b3a672173c6.png – giodamelio Mar 28 '11 at 10:10
A wifi card and Kismet/wireshark will likely cost you way less in terms of overhead. In the setup you're describing in that picture you're essentially telling your router to use the sniffer box as default router, and the sniffer then forwarding traffic to the actual modem... – Shadur Mar 28 '11 at 11:18
up vote 1 down vote

You can connect modem directly to your computer and make router so send all traffic through your debian system. In this case you may do anything you want with packets.

P.S.: do you need something like this?

share|improve this answer
up vote 0 down vote 
tcpdump -i ethX -w capturefile net x.x.x.x/y

Where ethX the card which receives this traffic and x.x.x.x/y is the cidr of the wireless network. This should capture anything coming or going to this network and save it to "capturefile" file. Add and port 80 in the end if you want only web traffic.

This looks like a "honeypot" setup. If you are trying to capture http sessions and/or other private information, this is illegal. Even if those users are trying to steal your internet connection. Unless you've acquired permission from those who use the wireless network, this is probably illegal.

EDIT:

I thought you already had setup the rerouting part. If you're asking how to reroute the specific traffic, it is possible but it depends on the hardware you have and probably I can't help you on that.

share|improve this answer
If it's his own wireless network I don't see why it'd be illegal to sniff on it - if I'd need written permission from every single customer of our ISP before being allowed to run tcpdump or wireshark to debug a problem I'd never get anything done. – Shadur Mar 28 '11 at 11:20
Sorry, I wasn't clear enough, my bad. I meant it is illegal if he wants to capture live http sessions and steal cookies or passwords. I can't see any other use for this setup, or he'd probably need a proxy server. – forcefsck Mar 28 '11 at 11:30

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.