Basically, with a Raspberry Pi and a couple of USB ethernet dongles, you can tap any connection (say between your computer and your router, or even between your router and your modem), and see all of your network traffic on Google Maps! You can also use a single USB ethernet dongle if you have a network sniffer, a spanning port, or an old school hub.
To install TapAndMap, first download the necessary files from github at:
After you have the files, here's how you install your TapAndMap (instructions are current as of 28 Dec 2017):
-) download 2017-11-29-raspbian-stretch-lite.zip and unzip it to 2017-11-29-raspbian-stretch-lite.img
-) copy that to your SD card (I did dd if=2017-11-29-raspbian-stretch-lite.img of=/dev/sdb, but BE CAREFUL to know what you're doing so that you don't nuke your main OS or something)
-) boot into the Raspberry Pi with a keyboard and mouse (username/password is pi/raspberry)
-) enable ssh on the pi by doing this: 'touch /boot/ssh' and reboot, and maybe change the pi password if you like (passwd pi)
-) set up your networking:
If you want it, I included an 'interfaces.gz' file. I just copied the 'interfaces' file to /etc/network/interfaces
update /etc/resolv.conf for your DNS server of choice
kill dhcpcd just in case it gets in the way
update-rc.d dhcpcd disable
service dhcpcd stop
apt-get update -y
apt-get dist-upgrade -y
-) install these packages
apt-get install tcpdump -y # needed to sniff and in case you need to troubleshoot
apt-get install screen -y # needed to ssh into the pi, run a script, and leave it running by 'ctrl-a d' out of that screen, and 'screen -x' back into it if necessary
apt-get install python-pcapy -y # needed to parse packets
apt-get install bridge-utils -y # needed to make a bridge
-) install MaxMind GeoIP database and test it out
apt-get install geoip-bin geoip-database -y
Get the MaxMind GeoLiteCity database by going to https://dev.maxmind.com/geoip/legacy/geolite/ and download the binary/gzip file.
extract the GeoLiteCity.dat.gz file with gunzip GeoLiteCity.dat.gz
mv GeoLiteCity.dat /usr/local/share/GeoIP/
test that your GeoIP lookup works with 'geoiplookup -f /usr/local/share/GeoIP/GeoLiteCity.dat x.x.x.x' where x.x.x.x is a public IP address that you'd like to look up
-) install apache
apt-get install apache2 -y
Test it by going to the IP address with a browser.
change its home directory from /var/www/html to /var/www
edit the file /etc/apache2/sites-enabled/000-default.conf to make the 'DocumentRoot /var/www' (it was /var/www/html on the newest version)
service apache2 restart
Test it by going to the IP address... you should see an index listing now
-) Transfer over the TapAndMap website files
copy the var-www-files.tar.gz to /tmp with something like this: scp -p var-www-files.tar.gz email@example.com:/tmp/ (the '-p' will keep file permissions... that's always a good idea, as is scping them to /tmp/)
extract in the pi's /tmp/ directory with something like this: tar -xzvf var-www-files.tar.gz
mv * /var/www/
Now when you open the site with the browser, you'll see the glorius TapAndMap page!
-) You'll need to create a bridged interface to sniff from, and add eth1 and maybe eth2 to it. If you have a spanning port or a hub and only one USB dongle, then just add eth1. If you have two USB dongles, and use your device to bridge between both of those dongles, then add eth2 as well
Thus, your /etc/rc.local file should have either this:
ifconfig eth1 up
brctl addbr br0
brctl addif br0 eth1
ifconfig br0 up
or it should look like this:
ifconfig eth1 up
ifconfig eth2 up
brctl addbr br0
brctl addif br0 eth1 eth2
ifconfig br0 up
you should see a br0 interface. This is important, as this is the interface that you'll sniff from. It can either be connected to one USB-to-Ethernet dongle (for a spanning port), or bridge two USB-to-Ethernet dongles
to make sure that it works, run 'tcpdump -i br0' and you should see packets flowing. If this doesn't work, then troubleshoot until you see packets flowing
-) Now we need to place two files in the /usr/lib/cgi-bin/ directory to allow for the GUI to reset the map or textual data with the user mouse-click
scp the usr-lib-cgi-bin-files.tar.gz file to /tmp/
extract it in the /tmp/ directory with 'tar -xvzf usr-lib-cgi-bin-files.tar.gz'
mv ResetScreen.sh /usr/lib/cgi-bin/
mv ResetText.sh /usr/lib/cgi-bin/
When you first go to the TapAndMap homepage in a browser, and click on a "Clear Map" or "Clear Text" button, you will get a 404 page Not Found error. This is because apache has forbidden access to the cgi-bin files.
First, you'll need to allow access to the cgi-bin files
edit the /etc/apache2/sites-enabled/000-default.conf file to uncomment the last line (#Include conf-available/serve-cgi-bin.conf)
Then modify that file that you've uncommented the line to point to (/etc/apache2/conf-available/serve-cgi-bin.conf). Mine looked like this:
ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
AddHandler cgi-script .sh
Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
Require all granted
Then modify the /etc/apache2/conf-enabled/security.conf file for access to the directory. I added these lines:
ScriptAlias /cgi-bin /usr/lib/cgi-bin/
Require all granted
Now, if you do a 'service apache2 restart' and click on the "Clear Map" or "Clear Text" button, you'll see the script. That means that it's accessable. But if you notice, it says "403 Forbidden" To make it run when clicked,
mv /etc/apache2/mods-available/cgi* /etc/apache2/mods-enabled/
This will copy the cgi mods from available to enabled, and allow you to execute the script on the buttons. This won't take effect until you do another 'service apache2 restart.' You may also have to clear the data in your history to make this work. The history has a way of messing up the data.
-) That should be it! Let's test it!
screen # and then space... this is so you can run the Run_TapAndMap_V1.3.1.py python script of TapAndMap and then leave it run and exit out of the terminal (yet still come back to it... way better than running it in the background with &).
You should see something like this:
"IPs to ignore are: 10. 169.254. 192.168. 172.16. 0. 223. 224. 225. 226. 227. 228. 229. 230. 231. 232. 233. 234. 235. 236. 237. 238. 239. 240. 255. 184.108.40.206 209.85. 172.217. 64.233. 216.58. 173.194. 74.125. 208.67.
'Ctrl-a d' to exit that screen, and you'll be back at your normal terminal
'ping www.china.cn -c 1' to send a ping to china
refresh your browser, and you should see the ping graphically going to China, and textually see it on the right pane
from your terminal, 'screen -x' will bring you back into your python script so you can see how it's doing. 'ctrl-a d' will detatch from that screen window again.
-) there is a /var/www/TapAndMap.conf file that will allow you to change your home lat/long, timezone, and how often the log will split. You might want to back this up before you mess with it.
Connection logs are stored under /var/www/logs/ anything in this directory can be deleted if you don't want it any longer
JSON Files (for maps) are stored under /var/www/JSONFiles/ anything in this directory can be deleted if you don't want it any longer
map htmp files are stored under /var/www/maps/ anything in this directory can be deleted if you don't want it any longer
There are a couple of script for your convienience and testing. Try out /var/www/PingWorld.py and /var/www/ScanWorldWithUDP.py if you need to generate test traffic.
If you run into problems, like your browser not refreshing when told to do so, first try deleting the files from the browser history... This will usually fix it. This is a known bug (known that it exists, cause/fix is still unknown).
That's it! You're now mapping your network traffic!
1 Sep 2018 update:
To fix that, I updated the index_template.html and map_template.html line which read:
How do you get a key you ask?
and it will say "Welcome to Google Maps"