Back in 2024 I set up self-sniff, which was a passive traffic collector. However, it suffered from the problem that the machine does not reboot when power is restored, and is pass through for external traffic. I ended up removing it.
More recently, I tried again. I had no luck fixing the lack of boot on power recovery. I had looked at ethernet taps or mirrors, and found them to be very costly. Claude suggested using a managed switch - two ports would bridge, one would mirror, and the switch would boot on power restore. This turns out to work great.
This time Claude set up suricata and duckdb for the traffic logs. A couple successes:
- Most of my outbound traffic by connections was DNS! This was due to the lack of negative DNS caching.
- <2% of traffic (excluding dns) is unencrypted.
I wanted to do this to detect if I was the source of a AI scraper problem.