Years assessing consumer routers teaches something textbooks skip: the most useful traffic on a SOHO network may never touch an interface you can mirror upstream. The router knows, if you can capture from the right place.
rcap-ng is remote packet capture for embedded Linux: OpenWrt, ASUSWRT-Merlin, DD-WRT, stock vendor firmware, or anything else that can run a small libpcap-based agent. The router streams packets to a collector that writes rotated pcaps, structured JSON logs, Prometheus metrics, status snapshots, and a SQLite-backed alert index.
The operational part is the per-session Zeek pipe. Detector scripts turn cleartext credentials, service exposure, discovery traffic, and industrial protocol observations into alerts with replay commands filtered to the exact connection. The capture stays useful; the alert points to the right slice.
This comes directly from firmware and wireless assessment work: bridge offload quirks, the difference between a LAN bridge and a switch path, why -i any can double-count, and why cross-compile recipes have to target the toolchains real devices use. Run it over WireGuard, Tailscale, SSH, or a private management network; transport encryption is still treated as a separate hardening track.