"WAN Port mirror to LAN port1" Not Working

[RonB223]

I've been trying to setup a network monitoring system in my home so I can understand more about the traffic flows, who is using the traffic, sites visited, etc.  To accomplish this, I wanted to use the debug option for "WAN Port mirror to LAN port1" but for some reason, all I see is LAN level broadcast traffic, and no traffic to all hosts on my network.  I've checked and verified my system running TCPdump is connected to the right power (I even went through all ports moving the cable).

Does the mirror function work when the Orbi solution is in router mode?

[Mstrbig]

---

@RonB223 wrote:

I've been trying to setup a network monitoring system in my home so I can understand more about the traffic flows, who is using the traffic, sites visited, etc.  To accomplish this, I wanted to use the debug option for "WAN Port mirror to LAN port1" but for some reason, all I see is LAN level broadcast traffic, and no traffic to all hosts on my network.  I've checked and verified my system running TCPdump is connected to the right power (I even went through all ports moving the cable).

Does the mirror function work when the Orbi solution is in router mode?

---

If I remember correctly, "WAN Port mirror to LAN port1" is going to give you total traffic the WAN is broadcasting to the LAN. You would have to use 3rd party software to achieve what you are looking for. Some are free, others have free trials and others are pay.

[bobm33]

As far as I can tell, "WAN Port mirror to LAN port1" does not work at all, which is unfortunate...I have wireshark hooked up to that port with the 'feature' enabled and all I see is normal LAN broadcast traffic

[CrimpOn]

---

@bobm33 wrote:

As far as I can tell, "WAN Port mirror to LAN port1" does not work at all, which is unfortunate...I have wireshark hooked up to that port with the 'feature' enabled and all I see is normal LAN broadcast traffic

---

You are correct.  I did the same (exact) thing. Cabled my PC to Port 1 and set Wireshark to record everything. (Wanted to collect more than 24 hours, which would overflow the Orbi memory).  Was puzzled at the results.  (Actually exclaimed "WTF???") A senior person on the forum commented on what "Mirror to Port 1" actually means, but I cannot find the post. Hate it when plain meaning of words does not apply.

Since I have the "gen 1" Orbi, I save to USB now, which does not actually use all the space on a USB stick, but more than Orbi memory would hold.  Collects both LAN/WAN and I open the pcap files with Wireshark.

[bobm33]

Well, this is a fun thing I found out this evening:  If you telnet into your Orbi, you can run tcpdump.  There are a number of interfaces you can select (or all of them) and it seems to support most of the pcap filters.  netcat does not seem to be in the install, so figuring out how to get the output piped to another machine for real-time processing is my next challenge.  EDIT:  netcat is there, as  /usr/bin/nc