Can Wireshark Be Used To Monitor Another User's Web Activity

[AndyCan]

i want to be able to monitor web activity of another computer during the day. i know the ip address of the computer and was thinknig wireshark might do this for me? I've never used wireshark though and it looks confusing to say the least. So firstly i just want to check that its actually going to work. So am i on the right train of thought with this?

[Roberto]

Using wireshark to do this might be possible in theory but it's not the tool for the job at all, and will likely be totally impractical. Does the PC not go through a proxy server or gateway where its connections can be logged?

[twin--turbo]

If your on a switched network then wireshark will not be much cop unless you can mirror the switch port being used.

 

And as the other poster mentioned, it's not the tool for the job.

 

Also, do you have an AUP stating that you will be logging internet traffic? If not then you could be in trouble and don't bother trying to use the information directly if you have no AUP.

 

Rob

[pete]

Wireshark will work on a mirrored port, but the capture will be rather large and full of noise unless you know how to use it (and your post shows you don't).

 

A proxy would be better for a blow-by-blow log, whereas something like ntop would give you a broader idea of traffic from that IP.

 

What problem are you trying to solve (or prove/disprove)?

[AndyCan]

trying to determine how much time someone is wasting on facebook instead of working. Our traffic goes through a SonicWall TZ210 but unless im using it wrong, the logs in that brings up nothing useful.

[Oaktech]

If someone is on facebook, i suggest you get an AUP change banning facebook inside work hours passed by management in a hurry, make everyone aware that the terms have changed, then use firewall/proxy logging to catch those who have not sensibly complied with AUP. This may well be one of those all too frequent instances of trying to solve a training/HR problems with technology.

[AndyCan]

Where i work (its not a school) needs to use Facebook and doesn't want to ban it but at the same time i think before they talk to the person in question about it they want some actual statistics

[Domino]

NTOP might be an option? much more info than you really need, but should be able to show you each hosts time connected to each resource/ traffic downloaded (including web sites) ntop

 

but yet again a proxy might be a better idea, maybe a little smoothwall express box?

[plexer]

So management want a big IT stick to use against their employee rather than having a discussion?

 

Ben

[Oaktech]

I was about to say that surely a generic "We've noticed you spend a lot of time on Facebook, is it really all for the good of the company? conversation, followed by a period of fairly obvious observation giving the employee in question a chance to straighten up and fly right, would be a much less employee-moral-sapping-its-management-against-us way of dealing with it. If it continues after a warning, than either the employee is stupid or has an addiction. In which case i think employing a proxy server is the best way to do it.

[AndyCan]

the point is they only suspect the person is spending 'too much time on facenbook' that is why they want the actual numbers before they speak to the person about it.

 

i'll have a look at ntop thanks

[AndyCan]

should also say i have full access to the persons computer if there is a simple way to turn on logging of websites visited?

[Oaktech]

is there not just history in the normal history folders?

[twin--turbo]

I could spend all day on facebook and only pass a couple of Megabytes of data.. or I could spend five minuets and pull a lot more.

 

Rob

[pete]

So management want a big IT stick to use against their employee rather than having a discussion?

 

Ben

 

95% of the time it's ever come up here, the statistics have been in the employees' favour and has resulted in a "No, they're not messing around on the Internet instead of working" (which is all managers get and they need SLT sign-off for even that level of info). Discussions with employees can explode in your face if you're acting on what you think is happening, rather than what's actually happening.

 

For example:

 

Jeff's work is suffering, he didn't get the report finished for Bob, his manager. Bob notices Facebook open on Jeff's screen and thinks he's found the reason Jeff's isn't performing - he's slacking on the Internet. Bob calls Jeff into a meeting with HR and starts to discuss him spending too much time on Facebook.

 

Unfortunately for Bob and HR, Jeff's quite a private person and doesn't mix work and play. His work has been suffering because his Dad's just died and they're making funeral arrangement via Facebook. Bob and HR now feel like complete tools and Jeff is not very happy with them.

 

TLDR: The Big IT Stick can be used for Good as well as Evil. Just ensure it's not used for fishing trips.

[pete]

should also say i have full access to the persons computer if there is a simple way to turn on logging of websites visited?

 

You could use something like this: IE HistoryView: Freeware Internet Explorer History Viewer (first Google hit, not an indication of quality), or pasco (Pasco v1.0 | McAfee Free Tools) but you're relying on the end-user not flushing the history or use private browsing modes.