While I'm not familiar with OpenWRT, but since it's linux, it probably has the built in capability to capture traffic out of the box. I'd start by looking at the destination IP addresses, protocols (UDP/TCP), and the destination ports. /var/log/ufw.log (if OpenWRT uses ufw), /var/log/syslog, or wherever it logs traffic to MAC = which LAN device traffic originates from if not statically assigned via DHCP DST = destination IP SRC = your LAN IP device (makes things easy if you statically assign via DHCP) PROTO = protocol DPT = destination port the device is trying to connect to use nslookup on the $DST google search "port $DPT" If you have a specific manufacturer's brand device, search for which ports they use - Apple uses https://support.apple.com/en-us/HT202944 I have all pre-defined DHCP static addresses, and rules in my firewall/router that (a), block all incoming connections, (b) block all outgoing connections - except for those I define either by source, destination, protocol, or destination port number. This is heavy-handed restrictions on the outgoing side that requires maintenance but nothing escapes my LAN without me specifying it explicitly. I'm pretty sure that OpenWRT would be able to do the same thing. On Mon, 2020-02-10 at 17:36 -0600, o1bigtenor wrote: > On Mon, Feb 10, 2020 at 12:08 PM Kristopher Browne > <kris.browne at gmail.com> wrote: > > > > > > I would consider this a learning opportunity to instal/learnl > > packetbeat, Elasticsearch, and kibana, rather than using tcpdump or > > wireshark… Probably setup logging from the network devices to go > > there too. Might be able to correlate behaviors that would be > > harder with the disparate tools. > > > The three packages you mention all would appear to be part of the > same ecosystem. > > Am looking at these as an option. Any other option to suggest? > > TIA > _______________________________________________ > TCLUG Mailing List - Minneapolis/St. Paul, Minnesota > tclug-list at mn-linux.org > http://mailman.mn-linux.org/mailman/listinfo/tclug-list -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://mailman.mn-linux.org/pipermail/tclug-list/attachments/20200211/d1fb4381/attachment.htm>