I've been fiddling with this one for almost a week now.
My setup is: LAN (windows/linux PCs/servers) <-> CentOS gateway/firewall box <-> ISP
I'm trying to setup a monitoring solution which will track all network activity for the LAN (visited websites, skype connections, etc). I want the protocol, IP/dns, time and whatever other relevant information to make up a usage report. I don't need traffic data (contents), just traffic info. I'll need to be able to look back on a particular day and see what a particular host on my LAN did at some particular time-frame. basically, something like host-a, on day M, at hour H spent M minutes on site X, or skype or yahoo or whatever other protocol.
I tried many monitoring tools, but pretty much all of them monitor bandwidth usage (which is NOT what I want) or do live monitoring (no historical data) I tried these (pretty much all of them mentioned here on SU):
- ntopng
- BandwidthD
- darkstat
- nagios
- vnstat
(I may have tried others, these are the ones I recall)
I admit I may have missed some configuration that would make things work as I want, so I am open to revisit any of the above or others, provided I get some clear steps to enable logging the data and reporting it.
My CentOS GW box is GUI-less, so etherApe and some others are not an option (unless they can be daemonized and used in a browser or something for reporting). Also, looking for open source solutions (either rpm-based or source-based, no matter)
Thanks.
Later edit: I'm good for any network monitoring/sniffing also. Today I've been evaluating some solutions on this area and they look promising, although the fact that they deal with packets and not connections (which is what I'm interested) is making things a bit difficult.
The best I was able to come up with is:
tshark -i 3 "src host a.b.c.d and not dst host w.x.y.z and tcp[0xd]&18=2" -T fields -e frame.time -e ip.addr -e tcp.dstport -a duration:86400
where i=3 is the public/internet interface, a.b.c.d is the public IP of the "internet" interface on the GW and w.x.y.z is my public IP (so I rule out active communication between me and the host (as I do have at least 1 ssh connection there active) This seems to be logging the syn packet info just fine, however there is no way for me to know which workstation on the LAN initiated the connection...
any other hints/ideas?
