Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

Only with local network cards? #16

Unanswered
EdMueller asked this question in Q&A
Discussion options

Can i use only local network cards or is it possible to process the captured traffic from a fritz box router?
Perhaps something similar to the following solution:

How to use ntopng for Realtime Traffic Analysis on Fritz!Box Routers
https://www.ntop.org/ntopng/how-to-use-ntopng-for-realtime-traffic-analysis-on-fritzbox-routers/

You must be logged in to vote

Replies: 2 comments 2 replies

Comment options

The adapters from which you can choose are retrieved with the Device::list pcap method.

See here for more information.

You must be logged in to vote
0 replies
Comment options

Came here wondering about the same use case. Many modern network devices are able to export flow information via Netflow/IPFIX which could potentially parsed by a project like this to provide the same dashboard but from the perspective of the edge of your network. This would allow for the capture of internet flow information about all devices, including embedded or otherwise locked-down systems which might not be able to run the normal sniffnet tool natively.

You must be logged in to vote
2 replies
Comment options

Could your idea be related to #303?

Comment options

Kinda, but not really, and here's why: most network edge devices (think "routers") won't allow you to load agent software. The linked solution would let you grab packets from another host system, but not from the router at the edge of your network where you really would want this kind of visibility. Also, later in the thread they are linking to Nagios which isn't really related at all and relies on SNMP which will not give you the information you'd need (SNMP is mostly only going to export counters, so you'd only get a list of how many packets with no src/dst or port info). I'm not sure what they intend to accomplish w/ Nagios but it's unlikely to help here.

Routers with management tooling (think UBNT and Mikrotik etc) often offer a way to export information about network flows to a system in a standard format. The way that works is the collector software would have a UDP listener (often port 4739) and the router would be configured to send IPFIX flows to the collector. The collector does not need to be online for the router to function, so this can target a system running software occasionally (but flows sent while the collector is offline obviously won't be recorded). Then the software lights up, starts receiving flow detail, and can decode that to get information about each flow as it happens.

Breaking it down:

  • Home router is configured to send IPFIX flows to your PC's IP address on UDP 4739
  • At some point, Sniffnet launches on your PC and starts listening on UDP 4739
  • Sniffnet starts to receive flow information in IPFX format
  • Parse IPFIX to collect src/dst, port, bytes sent etc. Rust crate to do this is below.

Here's some more details that might help:

Wiki page: https://en.wikipedia.org/wiki/IP_Flow_Information_Export
RFC 7011: https://datatracker.ietf.org/doc/html/rfc7011
Rust crate to parse IPFIX: https://github.com/dominotree/rs-ipfix
IANA IPFIX field entities: https://www.iana.org/assignments/ipfix/ipfix.xhtml

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Category
Q&A
Labels
enhancement New feature, request, or improvement question Further information is requested

AltStyle によって変換されたページ (->オリジナル) /