To capture all traffic through the router for analysis
Install Merlin firmware build: http://www.lostrealm.ca/tower/node/79
Enable SSH server on router. Connect.
Install USB stick. Forgot how but not too hard. Had to format to ext2 using special SW on windows.
run “entware-setup.sh” as stated in https://github.com/RMerl/asuswrt-merlin/wiki/Entware
“opkg install tcpdump” <– installs tcpdump from entware
“tpcdump -c 1000 -i any -w mydump” while your working directory is on your USB stick. This causes the next 1000 packets on any interface to be saved to the file “mydump” in the directory where you run this command.
Login to your router web interface. Go to USB application->Servers Center->FTP Share->Enable FTP+Share with Account. Share the folder on your USB stick where you put the dump file. Or just share the whole stick.
Now use your FTP client (winscp is fine) to connect to your router. Download your dump file.
Go back to the router web UI and disable FTP and account share.
Load your dump file into wireshard or whatever you like to use.
To check which process on your windows is responsible for traffic, go to task manager, set to show column process id. The do “netstat -aon” and look up the matching port number and process id. Then go to task manager and match the process id for the port of interest to the process id column there.
If you know a nice tool that gives good overview and pretty graphs, let me know. Even better if it could read several separate files, combine them for statistics etc. etc. Just to see what is going on in my network. Paranoid tinfoil hat stuff.
Random experiments in software engineering 
Reblogged this on Max's IT World and commented:
Nice article on how to do tcpdump on your Asus RT-N66U router.
Thank you, this was very helpful.
FYI, to format the USB drive, you don’t need to use Windows (although I believe the open source app Ext2 Volume Manager can do it).
1) Put the USB drive into the router.
2) it may auto-mount it, so you’ll need to unmount it (e.g. umount /dev/sda1),
3) then run “mkfs.ext2 /dev/sda1”.
After that, the entware setup will work