This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I have a dual wan router (openwrt with mwan3). All I want is to detect which wan (which network interface) is used by each pc or application.

How do I do this?

asked 05 Jan '16, 06:30

bobptz's gravatar image

bobptz
6112
accept rate: 0%


How do I do this?

By looking at both sides of the router and then comparing the capture files. Things like TCP SEQ numbers, IP ID, etc. will help to identify identical session on the LAN/WAN side, even though the router might have changed the source IP addresses with NAT. You can do that either by capturing traffic on the LAN and WAN side in parallel (probably not that easy on the WAN side) or by capturing on the router itself (with tcpdump).

But looking at the conntrack table on the router (conntrack -L) is probably easier than analyzing pcap files in that way ;-)

Regards
Kurt

permanent link

answered 08 Jan '16, 15:54

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×14
×1

question asked: 05 Jan '16, 06:30

question was seen: 881 times

last updated: 08 Jan '16, 15:54

p​o​w​e​r​e​d by O​S​Q​A