Page 1 of 2

using wireshark with Gargoyle

Posted: Sat Oct 13, 2012 7:41 pm
by jemmyell
Hi,

Is there a way to make at least one port on a Gargoyle router provide all traffic that passes through? My goal is to have Wireshark monitoring for all my network traffic.

-James

Re: using wireshark with Gargoyle

Posted: Tue Oct 16, 2012 7:47 am
by MarkY
Would be interested to know this too..

Actually, is there a way to modify the inbuilt 'web usage' feature so it shows the full URL visited rather than the (sub)domain only?

Thank you.

Re: using wireshark with Gargoyle

Posted: Wed Oct 17, 2012 10:41 am
by MarkY
MarkY wrote:...is there a way to modify the inbuilt 'web usage' feature so it shows the full URL visited rather than the (sub)domain only?

Thank you.
Has this been query been overlooked or is it just not possible so people are giving it a wide berth? :)

I'm no developer but if anybody could point me in the right direction if this can be achieved, I don't mind getting my hands dirty trying...

Thank you for any help with this.

Re: using wireshark with Gargoyle

Posted: Wed Oct 17, 2012 2:57 pm
by pbix
Iptables and the -TEE target will be the way but I cannot tell you the specifics of how to make it work. Perhaps over at openwrt.org you could get help. If you do report your technique here.

Re: using wireshark with Gargoyle

Posted: Wed Oct 17, 2012 3:32 pm
by MarkY
pbix wrote:Iptables and the -TEE target will be the way but I cannot tell you the specifics of how to make it work. Perhaps over at openwrt.org you could get help. If you do report your technique here.
Hi Pbix - thanks for the reply.

I'll see what I can find out over at openwrt.org and happily post my findings here. Can you tell me some more about how the 'web usage' feature works (is generated) at the moment so I can give as much information as possible? Obviously, the web usage feature is not built in to openwrt's standard firmware but is a feature of Gargoyles...

Thanks again.

*Edit: https://forum.openwrt.org/viewtopic.php ... 50#p180850

Re: using wireshark with Gargoyle

Posted: Thu Oct 18, 2012 6:42 am
by MarkY
Well, the post over at openwrt.org didn't go to well:
Perhaps you should ask that at the Gargoyle web site & forum, not here
and
And over here we tell you to ask back there because the monitoring component is gargoyle specific, it does not exist in Openwrt.
Hopefully somebody here that deals with the logging development for Gargoyle will chip in and post whether it's achievable..

Thank you.

Re: using wireshark with Gargoyle

Posted: Thu Oct 18, 2012 7:08 pm
by jemmyell
Hi,

I found this at the myopenrouter site.

http://www.myopenrouter.com/article/109 ... R-WGR614L/

Is it possible to do this with OpenWRT as implemented in Gargoyle?

-James

Re: using wireshark with Gargoyle

Posted: Thu Oct 18, 2012 9:09 pm
by pbix
Your referenced post is the general direction.

You should ask about the --tee target over at openwrt.org as I suggested previously. Do not confuse the issue with Gargoyle specific features like web monitoring. You are asking only how to use Wireshark with Openwrt.

Gargoyle is built on OpenWRT. You are going to have to dig to get this to work so good luck.

Re: using wireshark with Gargoyle

Posted: Sun Jan 14, 2018 7:54 am
by Hercules
Yeah I know Holy Thread Resurrection Batman!

I just discovered my kids iPad flooding my Internet Connection with uploads. I dont know what it is doing so want to look into it deeper.

Following the instructions here I have run into a problem. https://medium.com/openwrt-iot/lede-ope ... de3e020cbb

So the opkg update worked ok but then this happened.

Code: Select all

root@Gargoyle:~# opkg install tcpdump
ERROR: No package named tcpdump found, try updating your package lists
I then tried just running tcpdump but it is not installed. So is anyone doing this? Can I get tcpdump installed onto my Gargoyle 1.9.2 running on a TPLINK WDR4300?

Re: using wireshark with Gargoyle

Posted: Sun Jan 14, 2018 2:18 pm
by ispyisail
I understand Openwrt and LEDE are merging so the source URL has changed

I understand this has been fixed in this build?

viewtopic.php?f=14&t=11437