I have a router which runs the Broadcom aeolus system: https://github.com/Broadcom/aeolus consisting of ecos and "normal" Linux. I want to dump all the WAN traffic (controlled by ecos I think) or at least the LAN traffic (controlled by Linux). The system is very limited, there are firewall rules, but nothing like iptables. Also something like tcpdump does not exist. There is busybox available and I could probably load a more recent version with more programs. Is there any decent way with busybox or other tools to get the data out via network or maybe dumping to an attached USB drive?


Since I want to capture WAN-LAN traffic and not (only) LAN-client PCs traffic, I need to do it from within the router. Sniffing the WAN signal going over coax is likely not trivial and requires special hardware which I probably can't afford.


If your router device is located locally, rather than on some server farm, you are probably better off snooping the network traffic from outside the device rather than getting an embedded platform to log network traffic. There are several ways of going about this, but here are two simple network based solutions that work and will do what you want by exploiting Layer 1 of the OSI model.

Ethernet Hub

Hubs are usually inexpensive, but they are becoming more difficult to find in stores (probably easy enough to find online though). A hub can be a clutch tool when troubleshooting wired ethernet network coms (hubs can be confused for unmanaged switches, so make sure whatever you find is actually a hub and now some kind of switch).

An ethernet hub floods traffic to all of its ports. These can be hard on networks, but you can take advantage of the fact that a hub forwards traffic at layer 1 to all ports to snoop on traffic to other devices. If you plug a PC into one port on a hub and then plug your device into another, you will be able to wireshark or tcp dump all traffic going to your router. This would be an easy - no config option to capture traffic.

Managed Switch

You can achieve similar functionality to a hub with most managed switches. Any switch that supports port mirroring can allow you to easily configure two ports to function similarly to how a hub would treat all of its ports.

Mirror two ports and connect a PC to one and your router to the other, then with any capture tools you can acquire traffic that is going to and from your device.

  • I am aware of these options. I think my question was not clear enough. I want either traffic on WAN or LAN from inside the router. Not everything going from the WAN interface to the LAN interface internally will make it outside to the actual LAN. In particular I'd like the WAN traffic. Maybe I could create a bridge from WAN to LAN, but this won't mean all the traffic will be forwarded outside to other computers on the LAN. Only in the latter cases a hub or switch would help. It needs to be done from inside the router. – wantan Mar 20 at 8:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.