2

I have internet at home. I wanted to keep a watch on who visited what without putting a computer on for 24 hours and running some proxy software on it. Is there a possibility to get a track of all the websites visited thru my router in 24 hours?

There are many cell phones connected to it as well.

closed as too broad by Neil Smithline, Iszi, Matthew, Tobi Nary, LvB Apr 19 '16 at 13:11

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    Depending on the router, you may have the options to be a MITM there. Remember that this does not help with tor or https. Also, this might be illegal. – Tobi Nary Apr 18 '16 at 10:26
  • But this is only for internal use. Nothing to do with legality, Do you know how to achieve this? Any web services I can enable. What router should I have? – Mac Apr 18 '16 at 15:54
  • @SmokeDispenser Depending on the router's (and administrator's) capabilities, MitM may be possible with SSL/TLS connections as well. The only substantial hurdles to jump through would be installing a root cert on client devices and/or dealing with applications/users that refuse to accept the proxy's certificates. – Iszi Apr 18 '16 at 19:14
  • 6
    @MacEven in "only for internal use" cases, this might still be illegal. You'd be best served by consulting with a lawyer if you are doing this for business purposes, and even at home I'd still suggest you at least Google about for the laws which are applicable to your locale. – Iszi Apr 18 '16 at 19:15
  • @Iszi another problem is most interesting websites do use HSTS now:) – Tobi Nary Apr 18 '16 at 19:37
3

You can run a local machine as the web proxy and point all others to use that for all http traffic. Squid is one option.

Another option is to setup one machine to be the DNS server, e.g, using bind. You can then collect all the DNS logs. You can set up your router to give this local DNS machine as the primary DNS server via DHCP.

Another way (albeit the hardest) is to collect all the traffic as pcap and run tcpdump (or wireshark) to parse it. This will require a switch with port mirroring or a machine with 2+ Ethernen NICs.

If you don't care about domains, you can probably make your router (if it supports it) to export traffic logs to syslog. You can then use Splunk or any other log manger to go through the IPs and reverse DNS them or use whois to figure what is the destination.

  • 1
    Squid is a nice option, if bandwidth is an issue. You can do caching with squid - or play a nice prank on your family members by making all webpages be in klingon or rotate images randomly. – hamena314 Apr 19 '16 at 7:35
  • Upvote for mentioning BIND. If the traffic itself is encrypted then even if you set up pcap (Wireshark) and spent hours looking at the data, the most you would get is the same as if you simply had your own DNS server. Plus, it is easy to just set the DHCP server in the home router to make all your non-static users automatically use your DNS. – SDsolar May 16 '17 at 21:25

Not the answer you're looking for? Browse other questions tagged or ask your own question.