I am using a Raspberry Pi 3B as a bridge between WiFi and another router in the network. My goal is to log all traffic (UDP and TCP) that's being sent by a connected device, such as a phone or a voice assistant. Not just metadata, but the actual packet contents need to be stored, ideally on an external hard drive.

My access point (using hostapd and dhcpcd) is already set-up and working. So how could I accomplish this?

  • 4
    Sounds like a job for tcpdump / wireshark. Check out RaspberryPi as a passive Man in the Middle Commented Sep 26, 2019 at 13:04
  • You do realise that's going to fill a hard drive very quickly. What possible need does that logging satisfy? You can't MitM encrypted traffic (it appears as just gibberish and you won't have the key). You're also going to violate GDPR if you're in Europe (unless you ask for consent). If your service asked for my consent I'd run away very rapidly and choose any other service.
    – Dougie
    Commented Sep 26, 2019 at 14:48
  • 1
    @Dougie yeah, I realize that. I am only performing a MitM attack on my own devices as part of a network activity analysis. Commented Sep 26, 2019 at 16:03

1 Answer 1


The capturing is a job for tcpdump. As you have a bridge, you can capture on either side (eth0 or wlan0), but I would recommend the side where the device you want to monitor is attached.

If you have additional devices, you will want to filter. You can use either the MAC address or the IP address. You can also omit the filter to capture everything.

tcpdump -s 1500 -w /large/disk/wlan0.tcp host
tcpdump -s 1500 -w /large/disk/wlan0.tcp ether host 00:11:22:33:44:55
tcpdump -s 1500 -w /large/disk/wlan0.tcp

The option -s specifies the packet capture size, 1500 is the maximum regular Ethernet packet size. The option -w specifies the file to write.

You can later read the file with the -r option. Again you can filter by host, port and many other properties.

tcpdump -r /large/disk/wlan0.tcp

You can also load the file into WireShark.

  • Note that if you are on a WPA encryped WLAN, you will only be able to see packets involving devices/systems that logged into that network after you. I.e., if you want to see everything, you have to get everyone else to dis- and re- connect. But from the context in the question (running the sniffer on the wifi AP) that doesn't seem like it will be an issue.
    – goldilocks
    Commented Sep 26, 2019 at 17:11
  • @goldilocks The PI is supposed to act as a bridge, so all traffic should pass unencrypted (or more specifically decrypted).
    – RalfFriedl
    Commented Sep 26, 2019 at 17:13
  • Yeah I was just adding that qualification ;) Might be good to know for those in posterity looking for a generic way to "log all packets sent by connected devices over WiFi" though.
    – goldilocks
    Commented Sep 26, 2019 at 17:14
  • @RalfFriedl I do not understand your comment. Why should encrypted ip packets decrypted readable on a bridge?
    – Ingo
    Commented Sep 27, 2019 at 8:15
  • It was just a reply to goldilocks and as such refers to WLAN encryption. If the PI is one endpoint of the WLAN (and it must be to pass the packets to the bridge) it must be able do decrypt the WLAN encryption. There may be additional encryption, such as SSL, that is not decrypted.
    – RalfFriedl
    Commented Sep 27, 2019 at 18:59

Not the answer you're looking for? Browse other questions tagged or ask your own question.