I am looking for a way to monitor mainly my internet traffic to see the most visited websites and the host that visited these sites. I am not able to put any agents or modify the settings on the devices connecting but I do control the wifi and and ASA.
If you are not interested in the actual content, but only the websites visited by machine, then a local, filtering/monitoring DNS server is the tool you are looking for (probably in combination with fixed IP addresses per machine, using the DHCP server of your router). For the VM's, you want to make sure, they get their individual IP addresses.
There are many options out there, some free and open source ones too. A local DNS server can:
- Log the websites visited
- Log the DNS queries by machine (with source IP)
- Have "user accounts" by IP. With fixed IP addresses, this allows to track usage by machine.
- Do filtering (not what asked, but my be useful)
Note: Product recommendations are off-topic, so I will not give them. Google for "local DNS filtering device", but then do not use the filter feature of these products.
Another "extreme" solution would be to use a Linux or BSD machine acting as a transparent bridge (one ethernet to the ASA, one ethernet to your LAN) and simply launch a
tcpdump with the good filtering options on it.
If you have some development skills, a better approach than
tcpdump would be a python script, based on
- Captures every outgoing packet (from LAN NIC to WAN NIC) to TCP port 80 & 443.
- Achieves DNS resolution (comfort).
- Tracks connection opening and closing (with the help of TCP flags).
- Tracks the amount of exchanged data.
- Logs Everything on a SQLite database
would do the job. There's tons of examples on internet regarding use of libpcap in python.
Then, you can develop a small frontend application or use something like
phpmyadmin to browse your database.
As an alternative to the transparent bridge (that, depending on your traffic, may become a bottleneck), maybe you can configure your ethernet switch to mirror all the traffic to a given port (where the capturing machine would be connected).