Network Monitoring

[AWMGolfer]

I know a number of threads have been posted about this but we are looking for something very specific with absolutely no luck so I thought to use this great resource. We currently have a system in place the allows us to block sites, keywords and so on with absolutely no issue, supplied by the state for free. However it has no live monitoring and that is the next step we need. What we are looking for is something that will live monitor all wired and wireless traffic on our network and list the url they are visiting, not the ip but the actual www. and will also store the log files. If it had a live running stream of traffic that would be great. We don't need it to be able to block or do anything like that as we have that piece covered, if it has it that's fine too as we just wouldn't enable that feature. The key though is live monitoring and that it shows the actual web address of what is being visited and shows the IP or MAC address of the computer visiting that site. Hopefully this makes enough sense, just trying to get this piece figured out. Thanks!

[Geoff]

If your using Squid, you can use SqStat. It's not pretty but it works.

 

http://samm.kiev.ua/sqstat/screenshot.png

[dany2010]

If your using Squid, you can use SqStat. It's not pretty but it works.

 

 

Hi,

 

Does that log usernames as well?

 

Just trying to setup squid to log usernames as well but you have to join to the domain first which is being a nightmare to do.

[twin--turbo]

I know a number of threads have been posted about this but we are looking for something very specific with absolutely no luck so I thought to use this great resource. We currently have a system in place the allows us to block sites, keywords and so on with absolutely no issue, supplied by the state for free. However it has no live monitoring and that is the next step we need. What we are looking for is something that will live monitor all wired and wireless traffic on our network and list the url they are visiting, not the ip but the actual www. and will also store the log files. If it had a live running stream of traffic that would be great. We don't need it to be able to block or do anything like that as we have that piece covered, if it has it that's fine too as we just wouldn't enable that feature. The key though is live monitoring and that it shows the actual web address of what is being visited and shows the IP or MAC address of the computer visiting that site. Hopefully this makes enough sense, just trying to get this piece figured out. Thanks!

 

What size institution are you, live web logs will scroll past faster than the speed of light if you have verbose output.

 

What are you actualy looking for?

 

Rob

[Geoff]

Hi,

 

Does that log usernames as well?

 

Just trying to setup squid to log usernames as well but you have to join to the domain first which is being a nightmare to do.

 

That isn't what the OP asked for, but yes, if squid has a username associated with the request it will be displayed by SqStat (you need Squid 2.6+ for this to work). Joining a Linux machine to a Windows domain with Samba and using NTLM auth for squid is fairly straight forward these days (At least it is on Ubuntu LTS Server). A lot of the weird bugs got fixed yonks ago.

[dany2010]

That isn't what the OP asked for

 

Oh yeah sorry. It will log all of that without joining and is simple to setup as well to just do that.

 

Joining a Linux machine to a Windows domain with Samba and using NTLM auth for squid is fairly straight forward these days (At least it is on Ubuntu LTS Server). A lot of the weird bugs got fixed yonks ago.

 

Not from what im finding, havnt found a single guide yet that matches each other and works. At this stage the window will be meeting the server soon.

[Geoff]

If you post a new thread detailing where you get stuck we can probably tell you what the problem is.