1

I am brand new to these forums so I apologize if I posted this in the wrong place but I had an idea that originated when I heard about the RPI Zero's ability to act as a USB Gadget or HID Device and I wondered if the same could be done with ethernet.

My idea was as follows, I have a PS4 that is connected to ethernet via a powerline ethernet cable, and I was wondering if I could put a Raspberry PI in the middle of the ethernet cable and the PS4. Would it be possible for me to log the traffic as it comes from the PS4 to the Raspberry Pi before sending it across the Pi to the ethernet cable that connects to the powerline ethernet cable? This would have a lot of possibilities as the PI could control or log the connection. Is this even achievable win any Pi?

If this is hard to picture here is a diagram it my wording doesn't make sense to others as it often doesn't.

Original Connection(What I have now): Ethernet<->PS4

New Connection(What I'm Theorizing): Ethernet<->PI<->PS4

The arrow just signal the bidirectional flow of data between the devices. I feel like there is some rule of networking that doesn't allow this but I have no idea.

  • Google wireshark. You don't need to put the device in between like this. Just have it on the same network. – Brick Jun 5 at 0:33
  • 3
    @Brick that is not true for wired Ethernet unless using an old fashioned hub, which are oddly hard to find nowadays. Baring that, However, one can buy wireshark taps and port mirrors for some cash, best investment I made last year . Doing this on RPI is problematic because the requirements for transparent forwarding are much stricter than one for routing or switching , timing wise, but it is feasible to do for fun or experimentation. A Wireshark tap (port mirror) is ~$200 for basic commercial product with USB interface and adds minimal delay (even a hub adds jitter and other issues) – crasic Jun 5 at 1:05
  • I don't really understand your comment, @crasic, but I'm sure that my comment is not universal to any network setup. (I didn't think it was worth an answer.) I can run Wireshark at home and at work with no special hardware and see traffic as I expect. I cannot, I think, see wireless traffic from a wired computer or vice versa though. If that was your point, that sounds right. (Been a while.) – Brick Jun 5 at 1:30
  • 1
    On a wired network you will only see broadcast and layer 2 arp crap, unless you are using a hub instead of a switch, which is rare to find today. Compare your Wireshark capture to one captured on the computer/device directly and you will see a big difference . Many devices are quite chatty on broadcast so you may not realize your capture isn't complete – crasic Jun 5 at 1:32
  • 1
    @Brick you have enough for answer as Wireshark is the way to go. The challenge is a passthrough /port mirror setup, hence my comment :) – crasic Jun 5 at 1:46
0

There are several possibilities to configure a Raspberry Pi to be "a man in the middle" (a very common hacking issue). Because I don't know what do you exactly want to achieve, I will show a simple configuration with a bridge. This is completely transparent to the PS4 but you are able to monitor any traffic of it.

Of course you need an additional USB to wired ethernet dongle because the RPi 3B+ has only one wired ethernet port. If you have plugged it in then with ip link show you will find it with interface name eth1. The built-in interface is named eth0. Now we can use systemd-networkd to build a bridge. I assume you are headless with your RasPi, means you do not have a monitor and keyboard attached to it. So you have ssh enabled and are logged in with it to the RasPi. First activate systemd-networkd. You have to be very careful because you have only one try. If you make a mistake/typo, then you cannot ssh into the RasPi again after reboot and you have to use a monitor/keyboard or start over again with a fresh flashed image.

# disable classic networking
rpi ~$ sudo -Es
rpi ~# systemctl mask networking.service
rpi ~# systemctl mask dhcpcd.service
rpi ~# mv /etc/network/interfaces /etc/network/interfaces~
rpi ~# sed -i '1i resolvconf=NO' /etc/resolvconf.conf

# enable systemd-networkd
rpi ~# systemctl enable systemd-networkd.service
rpi ~# systemctl enable systemd-resolved.service
rpi ~# ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf

Then setup the interfaces with this three files:

rpi ~# cat > /etc/systemd/network/02-br0.netdev <<EOF
[NetDev]
Name=br0
Kind=bridge
EOF

rpi ~# cat > /etc/systemd/network/04-br0_add-eth.network <<EOF
[Match]
Name=eth*
[Network]
Bridge=br0
EOF

rpi ~# cat > /etc/systemd/network/12-br0_up.network <<EOF
[Match]
Name=br0
[Network]
DHCP=yes
EOF

Double check your setup, you have only one try. Then Reboot and ssh into the RasPi again. Please note that the RasPi has very likely got a new ip address because the interface has changed to br0.

Now with tcpdump you can monitor the traffic of the PS4. Install it with

rpi ~$ sudo apt install tcpdump

Look at the raw traffic of the PS4, assuming it has the ip address 192.168.50.170:

rpi ~$ sudo tcpdump -Ai br0 host 192.168.50.170

For example here a snippet from captured data:

14:00:06.989081 IP lga34s11-in-f14.1e100.net.http > 192.168.50.170.42754: Flags [P.], seq 1:529, ack 75, win 236, options [nop,nop,TS val 1124648216 ecr 3263002954], length 528: HTTP: HTTP/1.1 301 Moved Permanently
E..DF...r.V...  ...2..P..mhYAn.4.....u+.....
C....}yJHTTP/1.1 301 Moved Permanently
Location: http://www.google.com/
Content-Type: text/html; charset=UTF-8
Date: Wed, 05 Jun 2019 13:00:06 GMT
Expires: Fri, 05 Jul 2019 13:00:06 GMT
Cache-Control: public, max-age=2592000
Server: gws
Content-Length: 219
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>301 Moved</TITLE></HEAD><BODY>
<H1>301 Moved</H1>
The document has moved
<A HREF="http://www.google.com/">here</A>.
</BODY></HTML>

Of course this are the raw data from an IP packet but even a newbie can see that google is telling the PS4 that the document has moved and that you have to look at http://www.google.com/. The PS4 has tried to GET http://google.com/.

-1

the solution is to use orange pi r1, only available on aliexpress (yes it is Chinese) it have 2 Ethernet sockets which you can bridge and put your code in between, now how to bridge this guy, sorry i am the wrong man. also note that this board is not heavily documented nor super user friendly (watch youtube reviews) so you might do a long journey,

hope you benefit

  • the bridging on rpi is easy as i remember, i have done it once to turn the pi into a router – Allaw Hussein Jun 5 at 21:04
  • i highly recommend Ingo solution, it is professional. but i though another answer might be handy. try his first. – Allaw Hussein Jun 5 at 21:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.