0

I need to monitor the websites being visited on my wifi network by the different IPs connected to the network. What is the best way to do this? I spent some time with Wireshark but I feel it is a bit overkill for doing this. Is there a cleaner/more efficient way to do this?

  • Hmm... Can you install OpenWRT or Untangle Linux on your wifi router? That way you'd be able to simply run tcpdump on all your interfaces and get the information right at the source. Or limit logging to all Ethernet traffic from / to the upstream port's NIC. – Parthian Shot Jul 18 '15 at 4:11
2

The exact answer to this depends on the level of control you have over the wifi network.

Assuming that you can dictate things like proxy servers, then the best option might be to install a forward proxy (something like squid) and then have that do the logging for you.

If you need to know actual URLs rather than just sites, you'll need to set-up SSL interception which involves things like deploying SSL root certs to your clients and also places a large responsibility on you to secure the proxy and certificate infrastructure (failing to do so could impact the security of everyone on your network), so I'd avoid that unless you really need to.

0

It depends on what hardware you have available.

For example, if you have the possibility of plugging in the network e.g. a Linux server, you could set it up as a gateway. It's more complicated, but way more efficient and a whole lot cleaner:

-- router ------ network server -- WiFi AP -- ( NETWORK: 192.168.3(*).2...254 )
   192.168.1.1   1.1        2.1    2.2  3.1(*)      

(*) or 192.168.1.1 *again*, if you *really* want to be sneaky

Then you could also set up Squid as a transparent proxy. At that point you can, in increasing order of difficulty:

  • log all sites visited transparently (privacy issues may apply) - bundled
  • employ caching: with suitable rules, I get top-notch performances out of my oh-not-so-great home DSL - almost bundled, need to setup rules
  • prevent some sites or file types from being visited at all (see ACL in the Squid manual), which in turn has great applications for anti-ad, malware blocking and so on - almost bundled, again you need to setup rules (but there are public lists for those)
  • add antivirus and antispam support (you need extra packages such as Amavis and SquidGuard)
  • all the above for SSL sites too (this requires setting up what amounts to a man-in-the-middle attack; doable, but leave it for last and be sure to read the documentation and tutorials).
0

My router can do this (verizon). Just go to the default gateway and look for tools. In my case it is disabled by default.

0

I once wrote a script in Python to sniff DNS requests off the wifi network and log website names (host+domain names) users are visiting/resolving. Using the Python scapy library, its quite simple. The data was logged into mysql in order to be able to get various statistic afterwards.

I dont't have the script available at the moment, but if you dont't find another solution, I could send you the script on monday.

  • i would love to see that script, being working on a solution like this for 2 weeks, and didn't manage to get any clean solution – Macumbaomuerte Sep 19 '16 at 15:00
0

Log dns queries and match them to client ip. Doesn't work if client changes dns server though. If one has a wifi network, they have a router as well. Router usually provides dhcp and dns services. Any decent wifi box has logging features that can be enabled to log traffic to some extent. Another way is to modify dhcp to provide another dns box which logs queries.

  • How do you log DNS queries in this scenario? – schroeder Jul 17 '15 at 18:57
  • you need to include these details in your answer – schroeder Jul 18 '15 at 6:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.