I have a dual wan router (openwrt with mwan3). All I want is to detect which wan (which network interface) is used by each pc or application. How do I do this? asked 05 Jan '16, 06:30  bobptz |
One Answer:
By looking at both sides of the router and then comparing the capture files. Things like TCP SEQ numbers, IP ID, etc. will help to identify identical session on the LAN/WAN side, even though the router might have changed the source IP addresses with NAT. You can do that either by capturing traffic on the LAN and WAN side in parallel (probably not that easy on the WAN side) or by capturing on the router itself (with tcpdump). But looking at the conntrack table on the router (conntrack -L) is probably easier than analyzing pcap files in that way ;-) Regards answered 08 Jan '16, 15:54  Kurt Knochner ♦ |
