Unable to see most UDP in tcpdump output on GS-AX3000

[dwp]

I am new to modern Asus routers and just got my 1st GS-AX3000. I managed to install Entware on the USB drive and installed the Entware tcpdump package so I can capture packets passing in the router and view them in Wireshark. I was pretty easily able to do this with my old Netgear R6400 (both v1 and v2) using its built-in tcpdump installation.

On a very basic level, this all appears to work on the new Asus. But after seeing the initial UDP connection and response between a device on my LAN to a server on the WAN, wireshark is NOT showing me the ongoing UDP traffic - at least not when filtering the data on the IP of the LAN device. However, I KNOW that the ongoing UDP conversation is happening fine as I can see the results of it via a web page. I find this strange indeed as this was all clear as day on the Netgear.

I decided to search in wireshark for the string that is the MAC of the LAN device. And I find a large number of them containing this information. They are all in localhost to localhost UDP packets and I suspect that the Asus is doing something that obfuscates (perhaps unintentionally, I don't know) what is going on from a wireshark perspective. At first I thought this might be the result of some form of traffic monitoring or QOS (or similar) but I have all of that disabled. There is, of course, the firewall that is enabled but I had one enabled on the Netgear as well.

Another possibility is a difference in the behavior of the tcpdump utility between the Netgear-installed version and the Entware-installed version on the Asus. The command line options used on each are identical (except for the name of the output file). I don't know the version info from the Netgear offhand. But this is what I see on the Asus:

tcpdump version 4.9.3
libpcap version 1.10.1 (with TPACKET_V3)

I am not really expert at all in any of this. I know just enough to be dangerous - to myself.

Any suggestions about what is going on here and how to eliminate it? Thanks!

 

[ColinTaylor]

This is likely because of the hardware acceleration used in Asus routers. It bypasses the normal network stack on the router to achieve its higher throughput. The only way to capture all the traffic is to disable hardware acceleration and accept the hit on throughput.

 

[dwp]

This is likely because of the hardware acceleration used in Asus routers. It bypasses the normal network stack on the router to achieve its higher throughput. The only way to capture all the traffic is to disable hardware acceleration and accept the hit on throughput.

Holy smokes! That was a fast response! Thanks. I have no idea how I might disable the hardware acceleration though. Any suggestion? Thanks

Edit: perhaps it has something to do with Symmetric vs Full-cone NAT <https://www.asus.com/support/FAQ/1045254>? Also, this is stock AsusWRT, not Merlin (sadly not available) and my WAN connection is only 16Mb/sec so doubt I really would see any benefit from hardware acceleration. But I have no idea really. I am more than willing to switch it on/off as needed. I just have no idea how to do so. Cheers

 

[ColinTaylor]

Unlike the very old Asus routers there's no GUI option to disable hardware acceleration. The router disables it automatically if it needs to. That's often the case when enabling certain QoS modes or AiProtection features.

 

[dwp]

Unlike the very old Asus routers there's no GUI option to disable hardware acceleration. The router disables it automatically if it needs to. That's often the case when enabling certain QoS modes or AiProtection features.

Thanks again. I did see this post <https://www.snbforums.com/threads/rt-ac86u-hw-acceleration-setting.45375/post-454515> but not sure if it is what I am looking for. I find that runner is not a known command. However, fc status returns this:

Flow Timer Interval = 10000 millisecs
Pkt-HW Activate Deferral rate = 1
Pkt-HW Idle Deactivate = 0
Pkt-SW Activate Deferral count = 0
Flow Low Pkt Rate = 10
Acceleration Mode: <L2 & L3>
MCast Learning <Disabled>
MCast Acceleration IPv4<Enabled> IPv6<Enabled>
IPv6 Learning <Enabled>
GRE Learning <Enabled>
4o6 Fragmentation <Enabled>
TCP Ack Prioritization <Enabled>
HW Acceleration <Enabled>
Notify Processing Mode <Hybrid>
OVS Flow Learning <Disabled>
Flow Learning Enabled : Max<16383>, Active<127>, Cummulative [ 39908 - 39781 ]

I already have a USB mount script setup and running. I could add something to it if there is a command I can use. Maybe fc config --hw-accel 0? fc disable? I feel like I am loading the gun pointing at my newbie head

 

[ColinTaylor]

I don't know how similar your router is to the other Asus models. Try fc disable and see if that gets you the information you want in tcpdump.

 

[dwp]

I don't know how similar your router is to the other Asus models. Try fc disable and see if that gets you the information you want in tcpdump.

Well empirical testing demonstrates that fc config --hw-accel 0 is not enough. It appears, however, that fc disable does the trick. So I have just set up my capture_packets script to bracket the call to tcpdump with fc dump;fc disable and fc enable. Thanks!