Can I log all network activities just for one device ?

[Tom_Hall]

Hi - I have a problematic device on my network - a T-Mobile Signal Box (this device doesn't have a user gui/command interface)

I was on Merlin 378.55 but I reverted to stock 378_5134, to see if that would fix things (it didn't)

So, is there an (easy) way for me, using my router (RT-AC87U), to log all network-type i/o - tcp&udp, just for this one device/ip address, so that I can help troubleshoot it with T-mobile support ?

 

[System Error Message]

Im not sure how you would do it with the rt-ac87u but if you have a storage you can use a manage switch to mirror traffic or you can use the sniffer on the router. Are you just recording the connections or the header and data. If its the connection than you can log it by using netstat with a filter for the device and store it in a file. To get the header you would need a sniffer for that. If your PC has 2 ethernet ports this is doable from your PC much easier.

 

[Tom_Hall]

I had simply been looking in the Router's System Log's Connections Tab, and hitting refresh, and finding events like these: (xx.xx.1.8 is the device)

udp 192.168.1.8:123 195.222.33.219:123 UNREPLIED
udp 192.168.1.8:123 192.33.214.47:123 UNREPLIED
udp 192.168.1.8:123 193.225.126.76:123 UNREPLIED
udp 192.168.1.8:4500 194.35.183.255:4500 ASSURED

but I'm not sure I'm seeing everything, also, I do not have a managed switch, or dual ethernet ports

 

[ColinTaylor]

Assuming the IP of your box is 192.168.1.8 you could use something like this:

# iptables -I FORWARD -s 192.168.1.8 -j LOG
# iptables -I FORWARD -d 192.168.1.8 -j LOG

Then look in the syslog for the messages, although there might be a lot of them which could have a serious impact on your internet performance.

(This only logs WAN to LAN and LAN to WAN, not LAN to LAN)

 

[System Error Message]

Depends on his internet speed. The dual core ARM wont have issue keeping up and if hes also using hardware acceleration than it would keep up. The issue is that hes gonna need a lot of space to store the log files in the range of many megabytes so he would need an external storage.

you're only seeing the connections, not the packet headers or data.

 

[Tom_Hall]

Thanks folks - I'll try your suggestions