1. Identifying the Correct EdgeRouter Interface
Before starting a packet capture, it's important to identify which Ethernet interface is handling the traffic you're interested in. EdgeRouters can have multiple physical interfaces, VLANs, bridges, and VPN tunnels, so selecting the correct interface matters. From the EdgeRouter command line, you can type:
show interfaces
You can also use the Linux networking command:
ip addr show
These commands help identify interface names, assigned IP addresses, and operational status. For example, if you're investigating traffic entering or leaving `eth2`, that's the interface we'll use in our capture. A quick reminder: EdgeRouter interface names can vary depending on the hardware model and configuration.
2. Capturing Packets Directly on eth2
One of the nice things about the EdgeRouter is that you can run tcpdump directly from its command-line interface. Once connected through SSH, enter the following command:
sudo tcpdump -i eth2 -nn
The `-i` parameter identifies the Ethernet interface, while `-nn` prevents DNS and service-name resolution, keeping the output cleaner. If you'd rather save the capture for later analysis, use:
sudo tcpdump -i eth2 -nn -s 0 -w /tmp/eth2_capture.pcap
The `-s 0` option requests full packet capture, while `-w` writes the packets to a PCAP file. The `/tmp` directory is a convenient temporary location on the router, but remember that EdgeRouter storage is limited. Avoid leaving large capture files behind.
3. Filtering Traffic to Find the Problem
Capturing everything on a busy EdgeRouter can generate a surprising amount of traffic. Instead, you can narrow the capture using Berkeley Packet Filter (BPF) expressions. For example, to monitor communications with a particular device:
sudo tcpdump -i eth2 -nn host 10.44.10.73
To isolate ICMP traffic, which is particularly useful when troubleshooting ping and connectivity problems:
sudo tcpdump -i eth2 -nn icmp
You can also filter by TCP or UDP port, source address, destination address, or a combination of these. This is especially useful when investigating firewall rules, routing between network segments, or traffic passing through a site-to-site VPN. Rather than guessing what the router is doing, you can actually see the packets moving across the interface.
4. Moving the Capture into Wireshark
Although tcpdump provides excellent command-line visibility, I generally prefer examining the resulting capture in Wireshark. You can save the PCAP file on the EdgeRouter and transfer it to your Windows workstation using SCP or another secure file-transfer method. Once opened in Wireshark, you can examine TCP handshakes, retransmissions, DNS queries, connection resets, packet sizes, and application conversations. This combination is particularly useful when troubleshooting an EdgeRouter because you can capture traffic at the router itself and then use Wireshark's graphical interface to investigate the details. It also means you don't need to install additional packet-analysis software on the EdgeRouter.
5. Understanding What the EdgeRouter Can Actually See
There is an important detail worth remembering when capturing traffic on a Ubiquiti EdgeRouter: capturing on `eth2` does not automatically mean you'll see every packet travelling across your network. Ethernet switches forward traffic based on destination MAC addresses, so the router normally sees traffic delivered to or transmitted through that interface, rather than unrelated conversations between other switch ports. If you need to inspect traffic between two other devices, you may need to configure port mirroring (SPAN) on your switch or use a network TAP. Also, hardware offloading and interface selection can influence what appears in a capture. If you're troubleshooting something unusual, compare captures on the relevant physical interfaces and VPN interfaces where appropriate. The important thing is to verify what you're capturing rather than assuming an empty packet window means nothing is happening.
You don't always need an expensive network analyzer to understand what's happening on your network. Your Ubiquiti EdgeRouter already provides a useful packet-capture capability through tcpdump. Combine that with Wireshark on your workstation and you've got a practical troubleshooting setup that can help uncover everything from simple connectivity problems to more complicated routing and VPN issues.
Sometimes the answer really is hiding in the packets!
