1

I have a cable internet connection that goes to a ASA firewall and then into my local network where i have several machines including many VM's on a ESXI server.

I am looking for a way to monitor mainly my internet traffic to see the most visited websites and the host that visited these sites. I am not able to put any agents or modify the settings on the devices connecting but I do control the wifi and and ASA.

2

If you are not interested in the actual content, but only the websites visited by machine, then a local, filtering/monitoring DNS server is the tool you are looking for (probably in combination with fixed IP addresses per machine, using the DHCP server of your router). For the VM's, you want to make sure, they get their individual IP addresses.

There are many options out there, some free and open source ones too. A local DNS server can:

  • Log the websites visited
  • Log the DNS queries by machine (with source IP)
  • Have "user accounts" by IP. With fixed IP addresses, this allows to track usage by machine.
  • Do filtering (not what asked, but my be useful)

Note: Product recommendations are off-topic, so I will not give them. Google for "local DNS filtering device", but then do not use the filter feature of these products.

  • One caveat is that all the devices must be configured to use the advertised DNS, rather than a private DNS setting such as 8.8.8.8 or 1.1.1.1 which offer the possibility of DNS/TLS which could obscure the domain requests. Fortunately this is usually the default setting. – Daisetsu Jun 17 at 6:55
  • @Daisetsu 8.8.8.8 is the public DNS server from Google. Not private at all. – Marcel Jun 17 at 8:58
  • @Daisetsu The OP could easily change his DHCP server (I guess he uses one) to advertise the private DNS server as resolver. – Marcel Jun 17 at 9:00
  • 1
    both Google (8.8.8.8) developers.google.com/speed/public-dns/docs/dns-over-tls and cloudflares (1.1.1.1) support DNS/TLS. On Android a private DNS entry is required to use TLS blog.cloudflare.com/… – Daisetsu Jun 17 at 14:10
0

Another "extreme" solution would be to use a Linux or BSD machine acting as a transparent bridge (one ethernet to the ASA, one ethernet to your LAN) and simply launch a tcpdump with the good filtering options on it.

If you have some development skills, a better approach than tcpdump would be a python script, based on libpcap that:

  1. Captures every outgoing packet (from LAN NIC to WAN NIC) to TCP port 80 & 443.
  2. Achieves DNS resolution (comfort).
  3. Tracks connection opening and closing (with the help of TCP flags).
  4. Tracks the amount of exchanged data.
  5. Logs Everything on a SQLite database

would do the job. There's tons of examples on internet regarding use of libpcap in python. Then, you can develop a small frontend application or use something like phpmyadmin to browse your database.

As an alternative to the transparent bridge (that, depending on your traffic, may become a bottleneck), maybe you can configure your ethernet switch to mirror all the traffic to a given port (where the capturing machine would be connected).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.