I have a MikroTik router that connects to a network with multiple endpoints. All the WAN traffic flows through this router and I would like to be able to monitor (not necessarily filter) the websites that are being accessed by the endpoints (HTTP/HTTPS).

I have packet sniffing set up on the MikroTik router with it streaming to my Windows server connected on the same network. Using Wireshark I can read all the packets and the IP's on the server, but there is no way to analyse the amount of times a website has been visited over a period of time if it is HTTPS.

I would like to be able to better analyse this; is there a way to do so, using Wireshark or another tool?

  • wireshark can do what you've asked – schroeder Jun 6 '17 at 12:55
  • 1
    yes I know wireshark can display https and http traffic, but a summary of most visited sites can only be generated for http traffic if I am correct. @schroeder – Simon Erasmus Jun 6 '17 at 12:57
  • What about Man-in-the-Middle-Attacks on your own devices? trustwave.com/Resources/SpiderLabs-Blog/… – anon Jun 6 '17 at 13:19
  • Are you able to display the sites visited and also display the amount of times they have been visited in a time period? @anon – Simon Erasmus Jun 6 '17 at 13:33
  • Welcome! I've edited the question to remove the request for tools, hopefully making it on-topic now. If you disagree with my edit, you can roll it back. To roll it back, click on the "edited ... ago" link. This takes you to the edit history, where you can roll back to an earlier version. However, I believe that in the form I gave it, it should be suitable for reopening. We forbid requests for tools because they tend to invite spam (among other reasons). But we understand that sometimes "use tool X" is the right answer to a problem. So, we have to walk a fine line there. – S.L. Barth - Reinstate Monica Jun 6 '17 at 13:47