I think about using a Pi to sniff LAN traffic in an fixed environment.

Main problem is that the Pi should not have an IP adress nor being "visible" in the network. I got an second lan interface (USB) and dont know how i can achieve it.

Furthermore it would be nice to get the capture files without too much trouble.

Any approaches? Is there a preffered distro?


1 Answer 1


If you have two ethernet devices (eth0, eth1) you can bridge them like this:

ifconfig eth0
ifconfig eth1
brctl addbr bridge0
brctl addif bridge0 eth0
brctl addif bridge0 eth1
ifconfig bridge0 up

Now you've got a passive bridge called bridge0 where all traffic send through eth0 and eth1 can be sniffed via wireshark/tcpdump or whatever.. bridge0, eth0 and eth1 got no IP.

If you need an IP you can do this:

dhclient bridge0

That will assign a IP address to that bridge (most networks got a DHCP server, if not you can assign static IPs too, you even can use a spoofed mac or whatever) - your pi is able to connect to that network to serve e.g. an Apache.

But I would prefer that way: buy a WLAN USB device which is hostapd compatible. plug it and install hostapd to turn your Pi into a wireless router. Now you can sniff eth0, eth1 traffic and if you need the PCAP data you can connect to your raspberry WLAN and get the files via SSH/HTTP or whatever you need..

I assume that this is only for personal usage or testing issues.

Any preferred distro? I'd prefer PwnPi! It is much smaller than KaliLinux or pen-testing distros. Furthermore, I don't need cool looking GUIs, I prefer a simple SSH shell :)

Even X server looks nice on pwnpi:

enter image description here

  • 1
    But nmap is not for pcap!
    – m3ta
    Jan 22, 2014 at 13:25
  • 1
    :P you´r right.. i mean tcpdump, i´ll change that. thx!
    – Alex Tape
    Jan 22, 2014 at 14:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.