0

I am wanting to set up a single logging point on my home network that logs URLs and search terms to monitor teenagers... um... activity.

I was thinking of setting up a computer between the cable modem and the router, which would capture all network traffic. The upside would be no need for arp spoofing, the downside would be you would lose specific device information for if the traffic was on a wireless tablet vs wired PC.

I have played with Kali a little, and while there are some cool things like driftnet, urlsnarf, and arpspoof, they all seem to be to target a single device, and seems most tutorials are for creating wireless hotspots.

With thousands of tools available, I am not sure where to start on this, where I am wanting basically a consolidated browser history from all devices on the network.

I have a PC with a 4 port GB network card and an SSD available with Kali installed. Is my plan of putting it between the router and modem good, or should I stick with arp spoofing past the router? The router is a Linksys 1200AC.

Improve this question
10
  • Do you have certificates installed on all the devices? You won't be able to extract anything besides the hostname if you can't decrypt the traffic.
    – user
    Aug 3, 2020 at 19:51
  • I have access to all the devices I suppose. I haven't played with installing certificates, but as long as I can do it on Apple, Android, and Windows then I could do that.
    – Alan
    Aug 3, 2020 at 19:54
  • 1
    You should probably just set up a Linux-based machine and use that for your router. That way you won't lose L2 information or need a second device. You'll need to make sure it's safe from the Internet, but I guess that's going to be easier than using some consumer router anyways.
    – user
    Aug 3, 2020 at 19:58
  • I could use pfSense I guess, but then I loose wireless without secondary access points. Can I log the things I want using pfSense or other equivalent? Is Man in the Middle the correct terminology for what I am doing?
    – Alan
    Aug 3, 2020 at 20:00
  • 1
    As you mention Ubiquiti (and probably their UniFi line), you might want to just drop in a Syslog server as described here like Splunk – there are alternatives – and start there. When you know what you are searching for, you will have a base to ask the proper questions. Please keep in mind, that while the kids are teenagers, they still have rights. And this includes privacy. Locking down certain domains can be achieved without canons in your firewall/ USG as well.
    – kaiser
    Aug 3, 2020 at 23:00

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .