Simple traffic monitoring with a Raspberry Pi
Connect the wired ethernet interface to regular network. Setup wireless interface as Access Point with WPS enabled. Especially useful to explore the activity of IoT devices.
Install required tools
1
| $ apt-get install hostapd dnsmasq
|
Edit/Create /etc/hostapd/hostapd.conf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
| interface=wlan0
driver=nl80211
channel=1
ssid=RPiProxy
wpa=2
# Change passphrase
wpa_passphrase=somePassphrase
wpa_key_mgmt=WPA-PSK
wpa_pairwise=CCMP
wpa_group_rekey=600
wpa_gmk_rekey=86400
# Enable WPS if needed
ctrl_interface=/var/run/hostapd
eap_server=1
wps_state=2
ap_setup_locked=1
wps_pin_requests=/var/run/hostapd.pin-req
device_name=USB2.0 WLAN
manufacturer=ATHEROS
model_name=WAP
model_number=123
serial_number=12345
device_type=6-0050F204-1
os_version=01020300
config_methods=label display push_button keypad
|
Edit/Create /etc/dnsmasq.d/monitor.conf
1
2
3
4
5
6
| log-facility=/var/log/dnsmasq.log
interface=wlan0
dhcp-range=10.0.0.10,10.0.0.250,12h
dhcp-option=3,10.0.0.1
dhcp-option=6,10.0.0.1
log-queries
|
Configure interfaces
1
2
3
4
5
6
7
| $ ifconfig wlan0 up
$ ifconfig wlan0 10.0.0.1/24
$ iptables -t nat -F
$ iptables -F
$ iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
$ iptables -A FORWARD -i wlan0 -o eth0 -j ACCEPT
$ echo '1' > /proc/sys/net/ipv4/ip_forward
|
Enable and (re-)start
1
2
| $ systemctl restart dnsmasq
$ systemctl unmask hostapd && systemctl start hostapd
|
Run tcpdump
1
| $ tcpdump -i wlan0 -s0 -n -w ~/monitor.pcap
|
To push the WPS button run