<html><head></head><body><div>While I'm not familiar with OpenWRT, but since it's linux, it probably has the built in capability to capture traffic out of the box.</div><div><br></div><div> I'd start by looking at the destination IP addresses, protocols (UDP/TCP), and the destination ports.</div><div><br></div><div>/var/log/ufw.log (if OpenWRT uses ufw), /var/log/syslog, or wherever it logs traffic to</div><div><br></div><div>MAC = which LAN device traffic originates from if not statically assigned via DHCP</div><div>DST = destination IP</div><div>SRC = your LAN IP device (makes things easy if you statically assign via DHCP)</div><div>PROTO = protocol</div><div>DPT = destination port the device is trying to connect to</div><div><br></div><div>use nslookup on the $DST</div><div>google search "port $DPT"</div><div><br></div><div>If you have a specific manufacturer's brand device, search for which ports they use - Apple uses <a href="https://support.apple.com/en-us/HT202944">https://support.apple.com/en-us/HT202944</a></div><div><br></div><div>I have all pre-defined DHCP static addresses, and rules in my firewall/router that (a), block all incoming connections, (b) block all outgoing connections - except for those I define either by source, destination, protocol, or destination port number. This is heavy-handed restrictions on the outgoing side that requires maintenance but nothing escapes my LAN without me specifying it explicitly. </div><div><br></div><div>I'm pretty sure that OpenWRT would be able to do the same thing.</div><div><br></div><div><br></div><div><br></div><div>On Mon, 2020-02-10 at 17:36 -0600, o1bigtenor wrote:</div><blockquote type="cite"><pre>On Mon, Feb 10, 2020 at 12:08 PM Kristopher Browne
<<a href="mailto:kris.browne@gmail.com">kris.browne@gmail.com</a>> wrote:
<blockquote type="cite">
I would consider this a learning opportunity to instal/learnl packetbeat, Elasticsearch, and kibana, rather than using tcpdump or wireshark… Probably setup logging from the network devices to go there too. Might be able to correlate behaviors that would be harder with the disparate tools.
</blockquote>
The three packages you mention all would appear to be part of the
same ecosystem.
Am looking at these as an option. Any other option to suggest?
TIA
_______________________________________________
TCLUG Mailing List - Minneapolis/St. Paul, Minnesota
<a href="mailto:tclug-list@mn-linux.org">tclug-list@mn-linux.org</a>
<a href="http://mailman.mn-linux.org/mailman/listinfo/tclug-list">http://mailman.mn-linux.org/mailman/listinfo/tclug-list</a>
</pre></blockquote></body></html>