Network Usage Logging

richardfranks · 10-01-2008, 03:05 PM

OK - here goes

I've had a look around, and spent about 45 minutes searching the forums, and I cant seem to find just what I'm looking for. Apologies if this has been asked before.

Basically, I have this setup.

At the moment, I have a belkin router that is NATing my internet connection. This is all well and good, but I can't necessarily trust the users who are on my network, so I want to put some logging / firewalling in place.

This will, of course, run on a linux box.

After I have set up this linux box, the setup I want to have is like this:

Code:

|----------|      |-----------|     |
|          |      |           |     |
| INTERNET | ---- | LINUX BOX |-----| LAN
|          |      |           |     |
|----------|      |-----------|     |

I have found many posts on how to log traffic using squid, and redirecting port 80 through it using iptables, but I cant seem to find any that allow you to log all network traffic. I want to be able to see how much of my bandwidth they have used up, so that I can work out if someone is using more than their allowance. Everyone has their own machine, so I can just use the IP/Mac (although I will run a DHCP server myself, so will assign them host addresses in the DHCP server to allow me to know what IP each person is) to log it.

The other thing I want to be able to do is deny traffic under certain protocols. So, for example, I dont want to allow bittorrent.

Any help would be much appreciated, because I'm completely stuck!

blackhole54 · 10-01-2008, 05:48 PM

iptables/netfilter can be used for monitoring. With the -v (verbose) option, iptables will report both the packet total and byte total of matching packages. For example:

Code:

[root@box root]# iptables -I INPUT -s 192.168.yy.zz
[root@box root]# iptables -nvL INPUT
Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
   64  4744            all  --  *      *       192.168.yy.zz        0.0.0.0/0

This shows 64 packets containing a total of 4744 bytes. (Quite low since I just created the rule.) I am illustrating on an INPUT chain, but, of course, for your purposes you will be using the FORWARD chain. In place of (or in addition to) the IP address, you can match on the MAC address.

You will need to do something to preserve data across reboots. At shutdown you can save data (to the file of your choice) with iptables-save and restore it at next boot with iptables-restore. Be sure to include the -c option in both cases. If you need to allow for the possibility of an improper shutdown (crash, power failure, etc), you will have to create you own daemon to monitor at intervals and simply accept the data loss that occurs between the last time the daemon checked and the improper shutdown.

iptables/netfilter can also be used to block access to specified destination ports. If you want to, instead, block based on actual protocol you will have to use software that inspects the content of packets, which is beyond my knowledge. And, of course, if the user is using end-to-end encryption, such as SSL, you can't inspect the contents.

Bit torrent should be pretty easy to handle since, for it to be effective, incoming connections must be port forwarded. W/o your specifically setting up such port forwarding, the user's download speed will get seriously curtailed by standard bit torrent software.

racracracrac · 10-03-2008, 11:57 AM

Its not really practical to log all access from all ports to all ports.

What is practical though it to use an IDS, like snort. It will attempt to flag bad things.

richardfranks · 10-04-2008, 08:04 AM

I cant say I've come across snort before. What does it do (not sure what an IDS does either).

The thing is, most of the data transfer that people are going to use are going to be for things like MSN, Skype, and stuff like that. I need to log them, because the HTTP will not give me an accurate representation of how much data people have used

chrism01 · 10-05-2008, 10:41 PM

You can use iptables to log traffic, but be aware that on a busy system that could be a lot of disk space. You prob want to pick protocols to log carefully.
snort: http://www.snort.org/ (Intrusion Detection System inc logging etc.)

blackhole54 · 10-06-2008, 02:41 AM

Quote:

Originally Posted by chrism01

You can use iptables to log traffic, but be aware that on a busy system that could be a lot of disk space. You prob want to pick protocols to log carefully.

If you use iptables to log every message then it can take a lot of disk space. But if all you want are total number of bytes, as I demonstrated in post #2, then the only disk space required is to save the totals across reboots, which is a very small file.

I demonstrated getting totals for an individual IP address. To break it down by port numbers, simply add more criterea to the rules. I am not aware of a way for iptables to do deep packet inspection, but there may be some modules available that I haven't taken the time to learn about.