Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm doing some research right now where I want to monitor a group of individuals uses of the web (with permission, of course).

I'm looking for the cheapest, and easiest way to collect network traffic, and if possible, send it secured to a remote location, while at the same time reducing the possibility of interrupting the users normal practices.

I've looked into a number of things so far, network taps would probably be useful as it would allow me get a copy of the traffic while leaving the original untouched. I've seen that these can be made fairly cheaply and easily with stuff I could get from Home Depot or the like.

The harder question is what I can use for the actual collection. I'm interested mainly in http traffic. I likely won't be on site where the users are very frequently, so it would be nice to have something I can put in place, and have it just work (if that's possible). I would like to avoid needing more heavy weight solutions like computers if possible, as I'd likely have to build one specifically for this.

share|improve this question

There are a number of ways to go about this, but they all depend on the level of access you have, equipment available, and time you want to spend setting it up.

If all of these users connect egress through a single network device (switch/router), a simple port mirror with a collector server on the end is all you need to get going.

In a previous job I achieved this in a small datacenter by port mirroring on our core Cisco switch to a Netflow collector. As I was dealing with relatively low volumes of traffic (<30Mbit), I used a single server for collection/storage/analysis, and for your purpose it looks like you may be able to get away with that. Commodity hardware can be used in this situation as well.

share|improve this answer
Yes, they'll all be going across a single Internet connection. Can you recommend any resources on port mirroring? Can you recommend any commodity hardware for achieving this? – Jamie Starke Oct 28 '11 at 5:20
Port mirroring largely depends on the device(s) you have. IF you could provide some details on that I might be able to help. By commodity hardware I mean just about anything with a functioning CPU/mobo/RAM/haddrive -- grab that 2-year-old workstation out of the storage unit and dust it off. – Garrett Oct 28 '11 at 5:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .