Is it possible to either monitor or if possible, set the web server to answer any and all http requests (directed at port 80) regardless of the target IP? I'm trying to figure out captive portal to generate a pop-up but don't even see the outgoing generate_204 requests to google despite the fact I have the dns server set up to direct everything to the esp8266 and I 'can' see the dns requests and responses.
I have a feeling the device is using a dns cache and not trusting the dns response and asking for the resource at the last known ip.
(specifically what I would be looking for, since this device is not intended to be connected to the internet, would be any requests being asked by a connected device for a host other than the esp8266 access point on port 80 for a given list of urls. Although a blanket request->host() != WiFi.softAPIP() is probably sufficient to justify a redirect.
Problem is, I'm seeing the DNS server respond with the softAPIP to queries, but the device(s) are apparently ignoring them and going to a cached address)
Is it possible to either monitor or if possible, set the web server to answer any and all http requests (directed at port 80) regardless of the target IP?
If a packet contains an IP address that is not that of the server, why would you expect the packet to arrive at your server?
It is the httpd daemon that determines what to do with packets that arrive at the server, if you are talking about a web server on a PC. You might be able to modify the daemon, but that has nothing to do with the Arduino.
Sniffing traffic is not a task for an ESP8266. If you really need to do that use a full fledged OS that supports putting a network interface into RAW mode to see all traffic on that segment.
Todays WiFi router don't send all traffic to every device so you see only traffic directed to you. If you control the DNS server and reply every request with the devices IP address you may get all traffic but not only the web traffic.
Define what device we're talking about. Are you trying to reverse engineer the protocol or are you trying a man-in-the-middle attack?
I have a feeling the device is using a dns cache and not trusting the dns response and asking for the resource at the last known ip.
If it's using a cache, just wait some time until the DNS entry expires and it should use the new entry.
I guess more of what I was looking for was something similar to the iptables rules in linux but a simple version for the esp. I looked into lwip but it's a bit of a learning curve. Before I dive headlong into learning it, it would be nice to know if it was even possible.
It appears the ESP8266 supports monitor/promiscuous mode, but you'll have a problem keeping up with normal network traffic using any Arduino processor.
This is definitely out-of-scope as lwip is not used in the Arduino-IDE. I cannot find any relation to the Arduino world. Ask that on an Espressif forum.