2

I have internet at home. I wanted to keep a watch on who visited what without putting a computer on for 24 hours and running some proxy software on it. Is there a possibility to get a track of all the websites visited thru my router in 24 hours?

There are many cell phones connected to it as well.

Improve this question
7
  • 2
    Depending on the router, you may have the options to be a MITM there. Remember that this does not help with tor or https. Also, this might be illegal.
    – Tobi Nary
    Apr 18, 2016 at 10:26
  • But this is only for internal use. Nothing to do with legality, Do you know how to achieve this? Any web services I can enable. What router should I have?
    – Mac
    Apr 18, 2016 at 15:54
  • @SmokeDispenser Depending on the router's (and administrator's) capabilities, MitM may be possible with SSL/TLS connections as well. The only substantial hurdles to jump through would be installing a root cert on client devices and/or dealing with applications/users that refuse to accept the proxy's certificates.
    – Iszi
    Apr 18, 2016 at 19:14
  • 6
    @MacEven in "only for internal use" cases, this might still be illegal. You'd be best served by consulting with a lawyer if you are doing this for business purposes, and even at home I'd still suggest you at least Google about for the laws which are applicable to your locale.
    – Iszi
    Apr 18, 2016 at 19:15
  • @Iszi another problem is most interesting websites do use HSTS now:)
    – Tobi Nary
    Apr 18, 2016 at 19:37

1 Answer 1

Reset to default
3

You can run a local machine as the web proxy and point all others to use that for all http traffic. Squid is one option.

Another option is to setup one machine to be the DNS server, e.g, using bind. You can then collect all the DNS logs. You can set up your router to give this local DNS machine as the primary DNS server via DHCP.

Another way (albeit the hardest) is to collect all the traffic as pcap and run tcpdump (or wireshark) to parse it. This will require a switch with port mirroring or a machine with 2+ Ethernen NICs.

If you don't care about domains, you can probably make your router (if it supports it) to export traffic logs to syslog. You can then use Splunk or any other log manger to go through the IPs and reverse DNS them or use whois to figure what is the destination.

Improve this answer
2
  • 1
    Squid is a nice option, if bandwidth is an issue. You can do caching with squid - or play a nice prank on your family members by making all webpages be in klingon or rotate images randomly.
    – hamena314
    Apr 19, 2016 at 7:35
  • Upvote for mentioning BIND. If the traffic itself is encrypted then even if you set up pcap (Wireshark) and spent hours looking at the data, the most you would get is the same as if you simply had your own DNS server. Plus, it is easy to just set the DHCP server in the home router to make all your non-static users automatically use your DNS.
    – SDsolar
    May 16, 2017 at 21:25

Not the answer you're looking for? Browse other questions tagged .