Enabling Port mirroring Asus RT-AC66U

[miazza]

"TEE" was added by Merlin back in November.
Bear in mind that this isn't "real" port mirroring. It's only duplicating packets that are routed through the router. If you want to capture packets destined for the router itself you would be better off installing Entware and the tcpdump package.

Thank you for the advise and suggestion.
I'm not very familiar with Entware and tcpdump .... but I can study
https://github.com/Entware/Entware-ng/wiki/Install-on-asuswrt-merlin-firmware
http://www.tcpdump.org/
https://github.com/RMerl/asuswrt-merlin.ng/tree/master/release/src/router/tcpdump-4.4.0

 

[ColinTaylor]

Does anyone have updated information on port mirroring on an RT-AC86U router?

Have you tried the updated commands in post #15?

 

[ColinTaylor]

well I last had -gw , and now I tried --gateway.

I get an error now, no chain...

Are using also using TEE instead of ROUTE?

 

[ColinTaylor]

Your going beyond my knowledge in iptables.

All I was asking was whether you were actually using the command shown in post #15 which uses TEE instead of ROUTE.

 

[octopus]

View attachment 21555

You have spell modprobe wrong...

 

[ColinTaylor]

Try typing the modprobe command in correctly.

 

[FastEddieP]

Great topic and really good info, thanks!

Quick question: Is there a way to designate the mirrored traffic go out a specific physical lan port on the Asus router?

 

[ColinTaylor]

Quick question: Is there a way to designate the mirrored traffic go out a specific physical lan port on the Asus router?

No, only to an IP address.

 

[ColinTaylor]

event spelt right... not found.

screenshot?

 

[octopus]

event spelt right... not found.

You use this: modprobe xt_TEE in ssh shell and what is output of it?

 

[MarceloCosta]

Hello all,
Not sure if someone already tried to do it on a Asus RT-AX88U, but every time I do the iptables commands, the router reboots.
Any idea?

 

[ColinTaylor]

What are the exact commands you are entering?

 

[MarceloCosta]

I tried:

# iptables -A PREROUTING -t mangle -j ROUTE --gw 192.168.0.251 --tee
# iptables -A POSTROUTING -t mangle -j ROUTE --gw 192.168.0.251 --tee

and

modprobe xt_TEE
iptables -t mangle -A PREROUTING -s 192.168.0.1/24 -j TEE --gateway 192.168.0.251
iptables -t mangle -A POSTROUTING -d 192.168.0.1/24 -j TEE --gateway 192.168.0.251

(I need to reroute all traffic to Greycortex Mendel at my home lab for a training)

In both cases, the router rebooted after I applied the commands, sometimes right after the first or second command.

I'm using Asuswwrt merlin 384.19 firmware, but the same issue happens with stock firmware.

 

[Jason A]

Hi all,

Can this functionality be built into the front end of Merlin? Actually, I do not think the settings survive a reboot, is that correct?

I would like to mirror all my traffic to a RPi running ntop.

Thanks

Jason

 

[ColinTaylor]

You could use a user script if you want the commands to survive a reboot. It's probably a bad idea to leave it permanently enabled though as I imagine it could have a noticeable impact on the router's performance.

 

[pollenflugkalender]

I tried:

# iptables -A PREROUTING -t mangle -j ROUTE --gw 192.168.0.251 --tee
# iptables -A POSTROUTING -t mangle -j ROUTE --gw 192.168.0.251 --tee

and

modprobe xt_TEE
iptables -t mangle -A PREROUTING -s 192.168.0.1/24 -j TEE --gateway 192.168.0.251
iptables -t mangle -A POSTROUTING -d 192.168.0.1/24 -j TEE --gateway 192.168.0.251

(I need to reroute all traffic to Greycortex Mendel at my home lab for a training)

In both cases, the router rebooted after I applied the commands, sometimes right after the first or second command.

I'm using Asuswwrt merlin 384.19 firmware, but the same issue happens with stock firmware.

Hello Marcelo

I have a similar requirement and the same problem.

I want to mirror any traffic in-/outgoing from/to the internet through my RT-AX88U and send it to my RPI.
Have you found a workaround in the meantime? I am using the latest firmware 386.1_2 on a Asus RT-AX88U.
Is it maybe not possible/allowed to just use 192.168.0.1/24?

Regards
Polly