I have an unsecured network device which I am testing and need to find what packet data (non HTTP) it is spitting out to various places on the internet.

How can I use a Raspberry Pi 3 (with additional USB to LAN for a second NIC) to monitor network data passing through the device?

I have Linux experience and I was thinking of something like Kali, but are there any other Pi images around that could make this a lot easier/faster?

  • I'm not sure that Kali makes this easier than any other Linux image. Basically you want to set up your system as either a router or, probably preferably, a bridge (though you'll need to make sure you can configure the bridge to deliver packets not destined to you to your interface on the bridge). – Curt J. Sampson Apr 15 '17 at 20:25
  • There are a lot of tools out there to see network traffic. ... and need to find what packet data (non HTTP) it is spitting out to various places on the internet... Do you want to block any traffic? Do you want to count traffic? .... What's the root cause for your question? – framp May 16 '17 at 21:35

If you are able to put your Raspberry Pi between the device in question and the internet router, there is basically nothing special required.

You can start with tcpdump:

sudo apt-get install tcpdump
sudo tcpdump -n host 192.168.1.55

where 192.168.1.55 is the IP address of the network device you want to monitor. This will show you incoming and outgoing traffic for the specified IP address.

You can also try Wireshark. For both tools there are countless tutorials on the internet, but your filtering requirement seem to be really basic.


Kali Linux is just an Debian-derived Linux distribution with several (actually many) packages preinstalled and a cool-looking default interface. It does not really have any value in itself, the value is provided by the installed programs, but you can install them on Raspbian as well.

  • 1
    I like to do tcpdump [options] -s 0 -w file.pcap. What that does, is captures full packets and dumps them into the file specified by the -w flag. After you feel you have a good amount of data, I then use Wireshark to open the file to get a much better visual view of what's happening. It also allows you to capture on the Pi, and view the pcap file on another machine if you can't/don't want to install Wireshark on the Pi itself. – stevieb Dec 7 '16 at 14:23
  • 1
    Note that you need to have two separate networks and configuring your Pi as a router (including enabling IP forwarding) for the connected device to be able to talk to the rest of the world. – Curt J. Sampson Apr 15 '17 at 20:24

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.