Quick and easy setup for Packet Sniffing/Network Collection

Question

I'm doing some research right now where I want to monitor a group of individuals uses of the web (with permission, of course).

I'm looking for the cheapest, and easiest way to collect network traffic, and if possible, send it secured to a remote location, while at the same time reducing the possibility of interrupting the users normal practices.

I've looked into a number of things so far, network taps would probably be useful as it would allow me get a copy of the traffic while leaving the original untouched. I've seen that these can be made fairly cheaply and easily with stuff I could get from Home Depot or the like.

The harder question is what I can use for the actual collection. I'm interested mainly in http traffic. I likely won't be on site where the users are very frequently, so it would be nice to have something I can put in place, and have it just work (if that's possible). I would like to avoid needing more heavy weight solutions like computers if possible, as I'd likely have to build one specifically for this.

Answer 1

There are a number of ways to go about this, but they all depend on the level of access you have, equipment available, and time you want to spend setting it up.

If all of these users connect egress through a single network device (switch/router), a simple port mirror with a collector server on the end is all you need to get going.

In a previous job I achieved this in a small datacenter by port mirroring on our core Cisco switch to a Netflow collector. As I was dealing with relatively low volumes of traffic (<30Mbit), I used a single server for collection/storage/analysis, and for your purpose it looks like you may be able to get away with that. Commodity hardware can be used in this situation as well.