A friend of mine said he could know which apps are installed on certain device and which apps are interacting with each other through the router logs. Is that possible? Can the logs give such an info. For example, I've installed WeChat. Can the logs from the router show that I've installed WeChat?
Yes, “enterprise-class” routers can collect traffic information in multiple ways:
- An access-list could be applied to log all (or selected) traffic. (this could adversely impact the router’s performance depending on the amount of traffic being logged)
- The router could export “netflow” data to a netflow analyzer, which can generate reports on traffic. In high bandwidth situations netflow export is often “sampled”, allowing bandwidth reports but less useful for forensic analysis.
- The router can mirror data out a monitoring port, where a sniffer can analyze and/or store the packets.
- Some routers and firewalls have “application inspection” capabilities, allowing them to analyze traffic beyond the protocol/port/IP-address basis.
- Some routers have a “lawful intercept” feature-set, which I presume includes the ability to capture a subset of traffic.
Frankly, an easier way to see who is using a particular application is to set the DNS server (advertised in DHCP and IPv6 router advertisements) to a monitoring DNS server (such as openDNS).
You've asked very different questions and equated them, but I'll assume you mean "what apps are active on the network".
Yes, almost any router, even home routers, can do this. Most modern apps connect to the main service, so you can know what apps are active (installed, talking) by watching for connections to those services on the Internet.
By looking at how often they connect, the number of packets sent, or the size of the traffic, one can tell if it is an app or someone browsing to the site manually.
This is not fool-proof, and you would have to know that services each IP (or the TCP port) connects to, but it is possible.
Sophisticated routers with more features and more and different types of logging, including if they can inspect the traffic itself, can be more sure about whether traffic is app traffic or manual surfing.
In general that type of detection are carried out by using DPI techniques that identify types of traffic and the classify them. So if you have some traffic on port X that is detected by a signature Y that identifies WeChat, then you can claim that the origin of the communication is using WeChat. DNSs, HTTP hosts fields and many other values are used for this type of functionality.