Question

Hello Everyone.

I need to analyze network traffic between two LAN devices. It's an Ethernet/IP protocol connection, so I am looking for EIP and CIP protocol messages over TCP and UDP. I tried to find this information over the router web page, but I was not able to. I am wondering if it is even available anywhere. So I thought that I could set up a Port Mirror and sniff the traffic using a Windows sniffer SW. I did a search to understand if it is possible using RUT955, I did find some references to Port Mirroring page on settings, but I am not being able to find it on FW v7.2 (RUT9_R_00.07.02). I am wondering if it is hidden somewhere or if it was completely removed on latest firmware versions.

Anyone knows if is it possible to do this traffic analysis, or port mirroring using RUT955?

Thanks in advance. :)

Answer 1

Hello,

For traffic capturing you can use tools such as:

• TCP dump.
  • To install TCP dump on the router you need to enter the following commands:
    • opkg update;
    • opkg install tcpdump
  • For more information on TCPdump usage please refer to this page: https://www.tcpdump.org/manpages/tcpdump.1.html. By using TCPdump you can set certain options to filter packets according to set criteria and save this information to a file, which can be exported to a different environment for analysis. This wiki page explains, how to download files from a router:https://wiki.teltonika-networks.com/view/Upload_%26_Download_Files_from_RutOS.
• Wireshark. 
  • You can download the package from here: https://www.wireshark.org/.

Best regards,

Žygimantas