15
5
I want to mirror all traffic (also VPN, WLAN, WAN) from a consumer router (TPLink WR1043ND v.1.x) to a snort sensor located in the same network, but without extra hardware! The mirroring has to be done by the router (running OpenWrt Barrier Breaker).
Mirroring the WAN port of the router would even be supported by the current firmware, but the data of this stream is useless to me, because it does not contain the internal IPs of the devices connected to the router! I want the mirrored traffic from inside the router, with all internal IPs.
So, I quickly thought about tcpdump -i any
. But to my knowledge it is not possible to configure 'tcpdump' to stream the mirrored traffic directly to the snort sensor? (without generating and saving enormous pcap-files to the harddrive)?
How do I solve this?
Appendix: Would this work with using iptables --tee
option mirroring all traffic? I think I would need to install this 'TEE iptables extensions' ipkg or this 'Kernel modules for TEE' ipkg from the OpenWRT repository in order to work? Would this work or do I need something else?
1This is a good question, and I'm curious to hear any answers. I've voted to have it moved to Superuser, though, as they're more experienced with consumer gear and alternate firmware like OpenWRT. – EEAA – 2014-05-17T02:52:51.247