This will keep the monitored traffic separate from the monitoring traffic. Accessing the Monitoring resultĪs the Gigabit port of the Pi is used to receive mirrored traffic, the monitoring dashboard is accessed over the wlan0 interface. I used the Rasbian image for the pi and Ntopng can be easily installed from their repository using apt. It can aggregate and produce nice traffic analysis summary. To monitor traffic over long time I used Ntop. These tools give a live view of the packets going through my home network.

Once the traffic is available on the mirrored port, I was able to run traffic monitors like wireshark, tshark and tcpdump on the mirror port to analyze all the traffic between the router and ISP. All traffic monitoring happens on the Pi. The mirrored traffic is passed on to the Raspberry Pi. I used this to mirror traffic arriving through the router and the ISP connection. The NetGear GS105E switch provides the capability of port mirroring.

The following figure shows the connectivity. To get around the problem I decided to put the traffic monitor on the WAN side of the router. This makes traffic monitoring a bit of a problem on the LAN side. As with most people I have very few devices that connect to the router over an Ethernet cable, most devices are wifi capable.

The router provides both wire and wifi connectivity. I have a PPPoE connection to my ISP that connects to my home router. So, I decided to do a weekend project to implement traffic analysis on my home network. I had the Raspberry Pi laying around for some time without doing any major function and so was the NetGear switch.

Mikrotik routeros raspberry pi