Monitoring ASUS RT-N66U

To capture all traffic through the router for analysis

Install Merlin firmware build:

Enable SSH server on router. Connect.

Install USB stick. Forgot how but not too hard. Had to format to ext2 using special SW on windows.

run “” as stated in

“opkg install tcpdump” <– installs tcpdump from entware

“tpcdump -c 1000 -i any -w mydump” while your working directory is on your USB stick. This causes the next 1000 packets on any interface to be saved to the file “mydump” in the directory where you run this command.

Login to your router web interface. Go to USB application->Servers Center->FTP Share->Enable FTP+Share with Account. Share the folder on your USB stick where you put the dump file. Or just share the whole stick.

Now use your FTP client (winscp is fine) to connect to your router.  Download your dump file.

Go back to the router web UI and disable FTP and account share.

Load your dump file into wireshard or whatever you like to use.

To check which process on your windows is responsible for traffic, go to task manager, set to show column process id. The do “netstat -aon” and look up the matching port number and process id. Then go to task manager and match the process id for the port of interest to the process id column there.

If you know a nice tool that gives good overview and pretty graphs, let me know. Even better if it could read several separate files, combine them for statistics etc. etc. Just to see what is going on in my network. Paranoid tinfoil hat stuff.


2 thoughts on “Monitoring ASUS RT-N66U

  1. Thank you, this was very helpful.

    FYI, to format the USB drive, you don’t need to use Windows (although I believe the open source app Ext2 Volume Manager can do it).

    1) Put the USB drive into the router.
    2) it may auto-mount it, so you’ll need to unmount it (e.g. umount /dev/sda1),
    3) then run “mkfs.ext2 /dev/sda1”.

    After that, the entware setup will work

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s