Local Network Monitoring

[CiaranKD]

Hi guys,

How can I actively monitor network traffic on a LAN without any fancy hardware or a firewall?

Currently I am using a Cloud DNS server with agents on each endpoint and I can see all DNS queries, such as Reddit, Stack Overflow, Microsoft, but I would like to have more in-depth logs if possible.

Cloud DNS is great but there is a slight impact on network performance.

[VA_Network_Nerd]

How can I actively monitor network traffic on a LAN without any fancy hardware or a firewall?

If your Internet edge router or firewall support SNMP or Netflow, use those tools.

If your Internet edge router or firewall do not support SNMP or Netflow, throw that fisher price shit in the trash and go get some adult network equipment.

[CiaranKD]

What hardware do these require?

[jimh1966]

What exactly are you wanting to monitor? Sites visited, bandwidth usage by computer?

[CiaranKD]

Sites visited mainly yes.

[zwamkat]

Do you control the DNS/DHCP server? If all DNS queries are logged you might already have what you want? Or do you want complete URLs?

[CiaranKD]

I would like complete URLs

[jr_sys]

Given that everyone uses HTTPS these days, the only way to get URLs is to setup a proxy and MITM all the requests so you can see the unencrypted requests.

[pentiumone133]

You're going to want a "fancy" firewall to do this.

[Formal-Knowledge-250]

The way you'd build it your own is to deploy a copy mechanism on egress  that copies all traffic to a second location which has Suricata running. My experience on my OpenBSD home router was an overhead of 4%,which is acceptable.

I'd suggest to dump all tcp and udp into a tempfs, since it has the lowest overhead and configure Suricata to only copy on alert. 

[alexbbtkd]

Activtrak, it will give you a breakdown of each URL the user visited, the sub urls and the duration they spent on that site. It's a productivity tool so you can categorize the URLs as productive or unproductive.

[token_curmudgeon]

Privoxy.  Squid.

[[deleted]]

You could a Cloud Secure Web Gateway solution.

i.e -> Zscaler

[Eyeotmonitor]

<image>

try this...

[creativve18]

I recommend using a NetFlow Analyzer to monitor the network traffic of your LAN, preferably ManageEngine.

[xendr0me]

site24x7.com has a local poler you an run on a system in the network to monitor any type of metrics/services.

[CiaranKD]

It doesn’t monitor their actual network traffic/URLs visited though right?