0

So I am a beginner to RP4. I am trying to learn more about network security using the Raspberry Pi 4.

I managed to set up the raspberry pi 4 as an access point. I am able to connect my personal laptop to the SSID set up through the raspberry pi 4.

I have some general questions.

First off, when I type the command sudo route -n I get this:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0.       192.168.0.1     0.0.0.0         UG    202    0        0 eth0
192.168.0.0     0.0.0.0         255.255.255.0   U     202    0        0 eth0
192.168.17.0    0.0.0.0         255.255.255.0   U     303    0        0 wlan0

Is this correct? Because when I try to use the command sudo tcpdump -i eth0 -v dst 192.168.0.57 and src 192.168.0.1 Nothing happens when I browse the internet on my raspberry pi.

My last question is, how do I capture the packages when I browse on my personal laptop that is connected to the raspberry pi?

Improve this question
1
  • Hi and welcome to the site! I think we will need a bit more information to help you. It would be helpful to list what machine you are running each command from and what you expect to see. In general when dumping packets it's best to filter as little as possible at first. As you see what shows up you can use that to remove packets you don't want to see in future captures. This also might give you a clue as to why you aren't seeing what you expect to.
    – user1794469
    Commented Jun 13, 2020 at 3:16

1 Answer 1

Reset to default
0

I am able to connect my personal laptop to the SSID set up through the raspberry pi 4.

You forgot to mention which IP addresses are assigned to your laptop and your RaspPi.

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0.       192.168.0.1     0.0.0.0         UG    202    0        0 eth0
192.168.0.0     0.0.0.0         255.255.255.0   U     202    0        0 eth0
192.168.17.0    0.0.0.0         255.255.255.0   U     303    0        0 wlan0

Is this correct?

This says "the RaspPi has a default gateway behind the LAN, namely 192.168.0.1. This is where all 'Internet' requests will be routed to. It also connects to LAN on 192.168.0.*/24, and to WLAN on 192.168.17.*/24".

Since you use the RaspPi as an AP on WLAN, you somehow need to connect it to your internet router (but didn't tell us how) and by this table you used the LAN for it; then if that is the case, it is correct.

You need to give the output of ip addr on top of that to see which IP address it uses for eth0 and wlan0.

when I try to use the command sudo tcpdump -i eth0 -v dst 192.168.0.57 and src 192.168.0.1 nothing happens

This says "capture all packets coming from the router (192.168.0.1) and going to 192.168.0.57, whatever that address is".

As the router is not going to send any packets from itself except for infrastructure services running on it, and your Laptop should be on the WLAN, so it should have an 192.168.17.? address (whatever it is, you didn't say), it's no surprise you don't see anything.

Recommendation: Use wireshark instead of tcpdump, you get direct feedback and can adjust your filters.

If you want to inspect traffic from and to your Laptop, run wireshark on wlan0. Then the only additional traffic you'll see is that between the RaspPi and the Laptop, and that can only be causes by services running on the RaspPi (there shouldn't be too many of those).

If you want to filter, filter by your laptop's address (192.168.17.?) in a src ... or dst ... fashion ("show me all packets to and from the laptop").

Note that packets from the laptop going to the internet won't have 192.168.0.1 as destination address, but the address of whatever you contact on the internet, and similarly in the reverse direction.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .