Only with local network cards?

[EdMueller]

Can i use only local network cards or is it possible to process the captured traffic from a fritz box router?
Perhaps something similar to the following solution:

How to use ntopng for Realtime Traffic Analysis on Fritz!Box Routers
https://www.ntop.org/ntopng/how-to-use-ntopng-for-realtime-traffic-analysis-on-fritzbox-routers/

[GyulyVGC]

The adapters from which you can choose are retrieved with the Device::list pcap method.

See here for more information.

[aderusha]

Came here wondering about the same use case. Many modern network devices are able to export flow information via Netflow/IPFIX which could potentially parsed by a project like this to provide the same dashboard but from the perspective of the edge of your network. This would allow for the capture of internet flow information about all devices, including embedded or otherwise locked-down systems which might not be able to run the normal sniffnet tool natively.

[GyulyVGC]

Could your idea be related to #303?

[aderusha]

Kinda, but not really, and here's why: most network edge devices (think "routers") won't allow you to load agent software. The linked solution would let you grab packets from another host system, but not from the router at the edge of your network where you really would want this kind of visibility. Also, later in the thread they are linking to Nagios which isn't really related at all and relies on SNMP which will not give you the information you'd need (SNMP is mostly only going to export counters, so you'd only get a list of how many packets with no src/dst or port info). I'm not sure what they intend to accomplish w/ Nagios but it's unlikely to help here.

Routers with management tooling (think UBNT and Mikrotik etc) often offer a way to export information about network flows to a system in a standard format. The way that works is the collector software would have a UDP listener (often port 4739) and the router would be configured to send IPFIX flows to the collector. The collector does not need to be online for the router to function, so this can target a system running software occasionally (but flows sent while the collector is offline obviously won't be recorded). Then the software lights up, starts receiving flow detail, and can decode that to get information about each flow as it happens.

Breaking it down:

• Home router is configured to send IPFIX flows to your PC's IP address on UDP 4739
• At some point, Sniffnet launches on your PC and starts listening on UDP 4739
• Sniffnet starts to receive flow information in IPFX format
• Parse IPFIX to collect src/dst, port, bytes sent etc. Rust crate to do this is below.

Here's some more details that might help:

Wiki page: https://en.wikipedia.org/wiki/IP_Flow_Information_Export
RFC 7011: https://datatracker.ietf.org/doc/html/rfc7011
Rust crate to parse IPFIX: https://github.com/dominotree/rs-ipfix
IANA IPFIX field entities: https://www.iana.org/assignments/ipfix/ipfix.xhtml

[GyulyVGC]

Sniffnet could easily adapt that kind of information to the one already collected without even changing too much the underlying logic I think.
I could give this a try, but I'd like to first implement reading and writing of PCAP files (expected for v1.3).
Thanks very much for the ideas.