I used the below site to setup my Raspberry Pi as a Routed Wireless Access Point. The goal is to eventually monitor traffic on my home network. I was able to setup the Raspberry Pi as an access point but I'm not sure how to see the traffic on it and see what devices are connected to it. Any suggestion?
Add a comment
|
3 Answers
The optimal solution depend on the level of details you need.
If you need to get passwords from http conversations, wireshark is probably a good candidate.
If your need is to create statistics, tshark is possibly a better choice because you will be able to use text tools (grep, editor, etc).
But if you need to generate custom reports at regular intervals, I would suggest a Python application to collect all the data you need.
You can define your specific needs to get more detailed answers.
The easiest way is probably to enter the following command on terminal:
ss -rtu
Assuming you're using Debian-OS, ss should already be installed. Other options, such as -p, may also interest you (man ss).
-
I'm primarily looking to find all the hosts connected to the access points and all sites visited– kali pcCommented Oct 26, 2022 at 2:18
-
You do not specify if you need to store traffic for later analysis. If you only need snapshots, see answer. Commented Oct 26, 2022 at 14:37
Traffic
Use tcpdump and move the dump file to a computer with wireshark to examine it.
And to see connected devices:
IP
In dnsmasq.conf you ill have a line like this dhcp-leasefile=/var/lib/dnsmasq/dnsmasq.leases and that points to the file that contains leases that has got an IP from the DHCP server.
Example: cat /var/lib/misc/dnsmasq.leases
MAC
sudo arp | grep wlan0
Radio
I think its sudo iw dev wlan0 station dump
"iftop" is a ncurses based network monitoring tool. From it's man page "iftop - display bandwidth usage on an interface by host"
"vnstat" can provide traffic by the hour, day, week and month through an interface.
