...
A packet sniffer is a tool that can capture and analyze packets that are going to, leaving, or going through the router. Packet sniffing is very useful when you diagnose networks or protect against security attacks over networks.
Note |
---|
Unicast traffic between Wireless clients with client-to-client forwarding enabled will not be visible to the sniffer tool. |
Note |
---|
Packets that are processed with hardware offloading enabled bridge will also not be visible (flooded packets like unknown unicast, broadcast, and multicast traffic might be visible). |
Tip |
---|
Sniffer catches packets before they go into the firewall (direction=rx) or after they leave it (direction=tx). |
Packet Sniffer configuration
...
You can download captured packets from a file section. Then you can use a packet analyzer such as Wireshark to analyze a file:
Sub-menu: /tool sniffer
Note |
---|
Please note that sniffed packets will be available for 10 minutes, if you need them permenately, set a "file-name" to save the directly or issue a "save" command as described previously. |
Sub-menu: /tool sniffer
Property | Description | ||
---|---|---|---|
file-limit (integer 10.. | |||
Property | Description | ||
file-limit (integer 10..4294967295[KiB]; Default: 1000KiB) | File size limit. Sniffer will stop when a limit is reached. | ||
file-name (string; Default: ) | Name of the file where sniffed packets will be saved. | ||
filter-ip-addresscpu (integer; Default: ) | CPU core used as a filter. | ||
filter-ip-address (ip/mask[, (ip/mask[,ip/mask] (max 16 items); Default: ) | Up to 16 ip IP addresses used as a filter. | ||
filter-dst-macip-address (macip/mask[,macip/mask] (max 16 items); Default: ) | Up to 16 MAC addresses and MAC address masksIP destination addresses used as a filter. | ||
filter-src-ip-portaddress ([!]portip/mask[,portip/mask] (max 16 items); Default: ) | Up to 16 comma separated entriesIP source addresses used as a filter. | ||
filter-ipipv6-protocoladdress ([!]protocolipv6/mask[,protocolipv6/mask] (max 16 items); Default: ) | Up to 16 comma separated entries IPv6 addresses used as a filter. | ||
filter-dst-ipv6-address (ipv6/mask[,ipv6/mask] (max 16 items); Default: ) | Up to 16 IPv6 destination addresses used as a filter. | ||
filter-src-ipv6-address (ipv6/mask[,ipv6/mask] (max 16 items); Default: ) | Up to 16 IPv6 source addresses used as a filter. | ||
filter-mac-address (mac/mask[,mac/mask] (max 16 items); Default: ) | Up to 16 MAC addresses and MAC address masks used as a filter. | ||
filter-dst-mac-address (mac/mask[,mac/mask] (max 16 items); Default: ) | Up to 16 MAC destination addresses and MAC address masks used as a filter. | ||
filter-src-mac-address (mac/mask[,mac/mask] (max 16 items); Default: ) | Up to 16 MAC source addresses and MAC address masks used as a filter. | ||
filter-port ([!]port[,port] (max 16 items); Default: ) | Up to 16 comma-separated ports used as a filter. A list of predefined port names is also available, like ssh and telnet. | ||
filter-dst-port ([!]port[,port] (max 16 items); Default: ) | Up to 16 comma-separated destination ports used as a filter. A list of predefined port names is also available, like ssh and telnet. | ||
filter-src-port ([!]port[,port] (max 16 items); Default: ) | Up to 16 comma-separated source ports used as a filter. A list of predefined port names is also available, like ssh and telnet. | ||
filter-ip-protocol ([!]protocol[,protocol] (max 16 items); Default: ) | Up to 16 comma-separated IP/IPv6 protocols used as a filter. IP protocols (instead of protocol names, protocol numbers can be used):
| ||
filter-mac-protocol ([!]protocol[,protocol] (max 16 items); Default: ) | Up to 16 comma separated entries used as a filter. Mac protocols (instead of protocol names, protocol number can be used):
| ||
filter-stream (yes | no; Default: yes) | Sniffed packets that are devised for the sniffer server are ignored | ||
filter-direction (any | rx | tx; Default: ) | Specifies om which direction filtering will be applied. | ||
| |||
filter-stream (yes | no; Default: yes) | Sniffed packets that are devised for the sniffer server are ignored. | ||
filter-size (integer[-integer]:0..65535; Default: ) | Filters packets of specified size or size range in bytes. | ||
filter-direction (any | rx | tx; Default: ) | Specifies which direction filtering will be applied. | ||
filter-interface (all | name; Default: all) | Interface name on which sniffer will be running. all indicates that the sniffer will sniff packets on all interfaces. | ||
filter-operator-between-entries (and | or; Default: or) | Changes the logic for filters with multiple entries. | ||
filter-vlan (integer[,integer]:0..4095; Default: ) | Up to 16 VLAN IDs used as a filter | interface (all | name; Default: all) | Interface name on which sniffer will be running. all indicates that the sniffer will sniff packets on all interfaces. |
memory-limit (integer 10..4294967295[KiB]; Default: 100KiB) | Memory amount used to store sniffed data. | ||
memory-scroll (yes | no; Default: yes) | Whether to rewrite older sniffed data when the memory limit is reached. | ||
only-headers (yes | no; Default: no) | Save in the memory only the packet's headers, not the whole packet. | ||
streaming-enabled (yes | no; Default: no) | Defines whether to send sniffed packets to the streaming server. | ||
streaming-server (IP; Default: 0.0.0.0) | Tazmen Sniffer Protocol (TZSP) stream receiver. |
...
The quick mode will display results as they are filtered out with a limited-size buffer for packets. There are several attributes that can be set up for filtering. If no attributes are set current configuration will be used.
...
The submenu shows the list of hosts that were participating in the data exchange you've sniffed.
...