Network Monitor

agallant · 06-09-2004, 07:46 AM

My firewall has a report in it that tells me what the most visited sites are. I need to know whick computer on the network is going to a specific site. any ideas?

david_ross · 06-09-2004, 01:06 PM

Your best bet would be to install a proxy server like squid. Using a packet sniffer like ntop could work as well but it would only give you connection stats and not full URLs.

MS3FGX · 06-09-2004, 03:15 PM

The only way you could do that is have their IP logged by a proxy server, but that isn't much good if you are using DHCP. Maybe you could log their hostnames though.

david_ross · 06-10-2004, 12:35 PM

MAC addresses would be more useful than hostnames or ip addresses (ok they can be faked but joe bloggs doesn't know that)

LoK · 06-10-2004, 04:12 PM

I would suggust consulting your firewall docs. If it logs the popular sites odds are it also logs who is visiting them.

As other people have already suggested a proxy is a good solution but if you want to do it "NOW" then simply use a packet sniffer w/ rules to log all http traffic.

If it's a switched network you can have the switch replicate the data on your port (the data to/from the firewalls port) or simply install the sniffer on your firewall.