I want to use AR750 to capture network traffic between LAN ports and save to file by tcpdump. The problem is network speed is about 11MB/s，TFcard/USB disk writting speed is slower than 10MB/s. So tcpdump dropped many packets without writting to file.
The possible solution is either limiting LAN ports speed or speeding up TF/USB writing speed. Seems the latter one is impossible which limited by SoC chip speed. As CPU isn’t in the data path between LAN ports, so can’t use ethtool to limit bandwidth. Do you known how to limit LAN port speed in this case？
This seems not a rare use case, how do you guys transparently capture traffic between hosts with OpenWrt devices? Thanks in advance!
This is a good approach - in the other thread, I mentioned using either (a) ethernet hub, or (b) a smart switch with port mirroring, and like the mod-tee approach, using a third machine to capture the traffic direct with wireshark.
That’s why I was asking if the threads can be merged, as good ideas and contribs on both.
Thanks for your help！
Actually my setup is similar as your suggestion.
I already set port-mirroring. Instead of forwarding to PC, Packets forwarded to eth1@router CPU.
I don’t want to use another PC, I want to do capture and file writing directly on the router.
So seems unable to limit LAN ports bandwidth.
I would suggest against writing to flash storage as it has a limited lifetime and is slow. An external hard drive (or SSD) would be the best, a microSD or USB stick a reasonable second choice, if the write speeds are sufficient. Most USB drives aren’t good for much more than 5-10 MB/s (40-80 Mbps) write.
Yes，I know flash storage has limited lifetime due to no IO balance algorithm compared to SSD. But this isn’t an issue in my scenario, I only need to use it to capture data for only several hours.
My flash storage writing speed is more than 30M on PC, it isn’t the bottleneck. I suspect the bottleneck is AR750 router CPU’s SDRAM/DMA.
If can’t limit LAN port bandwidth, I plan to try data capture on GL b1300 router which has a better CPU and DDR3. Do you have performance data of USB storage writing on B1300?
ntfs and ext4 are journal filesys which have extra overhead and not suitable for flash storage. I used exfat, it’s optimized for flash storage. It is about 10MB tested with this command: dd if=/dev/zero of=./out.bin bs=2M c=50
I assumed the SD slot in the GL-750 is much faster than USB storage on the AR-300M.
Good to know – thanks.
And w/r to journaling that’s true. I use mine as a travel router so I’m frequently leaving a hotel room and I the router is downloading to the storage, and the power to the room shuts off - a non journaled filesystem is no good for me