0

A friend of mine said he could know which apps are installed on certain device and which apps are interacting with each other through the router logs. Is that possible? Can the logs give such an info. For example, I've installed WeChat. Can the logs from the router show that I've installed WeChat?

Improve this question
4
  • 1
    "... logs from the router ..." - this fully depends on what capabilities the "router" has. There is no generic answer to this since there is no generic "router" but instead a wide range of devices with a wide range of capabilities sold as router. But yes, with some this should be possible.
    – Steffen Ullrich
    Commented Jan 16, 2020 at 8:23
  • You've asked different questions but combined them together. What apps are interacting with each other? What apps are installed? Those are very different scenarios.
    – schroeder ♦
    Commented Jan 16, 2020 at 8:37
  • @Schroeder Like I gave the example in my question. Let's say, I've installed WeChat on my phone and chatting with my friend's regularly. Can I logon to my router and filter the logs by WeChat? Can I "know" that how much traffic has been generated by WeChat? Can I know the destination IP? Etc
    – Icarus
    Commented Jan 16, 2020 at 8:41
  • Ah, that's a different question entirely from what you asked. And the answer you accepted is not an answer to that. What is logged depends on the features of your router. Some routers can have custom or personal operating systems installed to can give you more features and logging like that.
    – schroeder ♦
    Commented Jan 16, 2020 at 8:48

3 Answers 3

Reset to default
0

Yes, “enterprise-class” routers can collect traffic information in multiple ways:

  1. An access-list could be applied to log all (or selected) traffic. (this could adversely impact the router’s performance depending on the amount of traffic being logged)
  2. The router could export “netflow” data to a netflow analyzer, which can generate reports on traffic. In high bandwidth situations netflow export is often “sampled”, allowing bandwidth reports but less useful for forensic analysis.
  3. The router can mirror data out a monitoring port, where a sniffer can analyze and/or store the packets.
  4. Some routers and firewalls have “application inspection” capabilities, allowing them to analyze traffic beyond the protocol/port/IP-address basis.
  5. Some routers have a “lawful intercept” feature-set, which I presume includes the ability to capture a subset of traffic.

Frankly, an easier way to see who is using a particular application is to set the DNS server (advertised in DHCP and IPv6 router advertisements) to a monitoring DNS server (such as openDNS).

Improve this answer
0

You've asked very different questions and equated them, but I'll assume you mean "what apps are active on the network".

Yes, almost any router, even home routers, can do this. Most modern apps connect to the main service, so you can know what apps are active (installed, talking) by watching for connections to those services on the Internet.

By looking at how often they connect, the number of packets sent, or the size of the traffic, one can tell if it is an app or someone browsing to the site manually.

This is not fool-proof, and you would have to know that services each IP (or the TCP port) connects to, but it is possible.

Sophisticated routers with more features and more and different types of logging, including if they can inspect the traffic itself, can be more sure about whether traffic is app traffic or manual surfing.

Improve this answer
0
0

In general that type of detection are carried out by using DPI techniques that identify types of traffic and the classify them. So if you have some traffic on port X that is detected by a signature Y that identifies WeChat, then you can claim that the origin of the communication is using WeChat. DNSs, HTTP hosts fields and many other values are used for this type of functionality.

Improve this answer
4
  • So what I was thinking is correct. I mean, simply logging on into the router and downloading and inspecting the logs doesn't tell us that we are using WeChat. It does need a ceetain level of tech stuff
    – Icarus
    Commented Jan 16, 2020 at 9:31
  • Is partially correct, bear in mind that some services are only available for specific applications, so if application X access a server Y on port 8080 and the number of bytes is higher than a threshold and other metrics you can claim that is application X. In general make application detection just with logs that contains ips and ports is not really accurate.
    – camp0
    Commented Jan 16, 2020 at 9:39
  • I agree. I downloaded the logs from my router to inspect what apps and websites were being accessed. Interestingly, the apps that are cloud based all point to destination address to Amazon. Assuming that the app is hosted on Amazon EC2 servers.
    – Icarus
    Commented Jan 16, 2020 at 9:43
  • In that case if your apps use the same service of AWS then will be tricky for you to make the identification based on the logs
    – camp0
    Commented Jan 16, 2020 at 10:25

Not the answer you're looking for? Browse other questions tagged .