How do I monitor router for illicit traffic?

[ryarber]

Is there a primer somewhere on how to monitor my router and look for malicious traffic? I have an ASUS RT 68 and run Merlin firmware.

 

[msheffer]

Wireshark

Sent from my SM-G930V using Tapatalk

 

[sfx2000]

Probably should be a bit more specific - WAN side or LAN side?

Illicit traffic can be many things - depends on the use cases there.

 

[ryarber]

Mostly concerned about WAN side.

 

[RMerlin]

You'd need to start logging every new connections. While some routers can do this locally, it will be quite resource-intensive, and will generally require logging to a remote syslog server. After that it would be up to you to analyze those logs.

Another option is to run something like snort on your router. Once again, this is quite resource-intensive, and might require something more capable than a standard home gateway.

 

[msheffer]

Make sure all unnecessary ports are closed too.

Sent from my SM-G930V using Tapatalk