up vote 0 down vote favorite
share [g+] share [fb]

I would like to monitor all traffic in my home network, and I believe that there is not much disk space in my router to record all that pass through. I could be happy enough if I could log only the HTTP domains accessed, or if I could save it externally.

link|improve this question
94% accept rate
Maybe some kind of cron job? Compress the log file with bzip and send it to somewhere via SCP? – Shiki Feb 6 at 23:04
@Shiki what log file? I haven't found any log file that contains the information I want in tomato. – Jader Dias Feb 6 at 23:07
1  
Can you set it up to send to a SYSLOG server? Then you can have the server log, filter, etc. however you like - plus the Syslog Server probably has plenty of disk space. I'm not familiar with Tomato, but my D-Link router can do that. Note that on D-Link you have to go to a non-obvious place to get it to log sites accessed - perhaps something similar on your router. – yosh m Feb 7 at 1:43
@yoshm Yes, syslog is already enabled – Jader Dias Feb 7 at 14:10
feedback

2 Answers

up vote 0 down vote

The closer I could get is to log all outbound or inbound connections in:

  • Administration > Logging > Connection Logging > Inbound or Outbound > If Allowed by Firewall

Then it will appear in the log like this

Feb 5 15:00:00 unknown user.warn kernel: ACCEPT IN=br1 OUT=vlan2 SRC=192.168.0.2 DST=61.61.61.61 LEN=52 TOS=0x00 PREC=0x00 TTL=127 ID=2973 DF PROTO=TCP SPT=51313 DPT=80 WINDOW=4096 RES=0x00 SYN URGP=0 OPT (010203B30203030101020302)

From the DST field I can guess the target domain using a reverse DNS lookup

link|improve this answer
feedback
up vote 0 down vote

Since everyone uses my router as an DNS server and Syslog was already enabled, all I had to do was go to

  • Advanced > DHCP / DNS > Dnsmasq Custom Configuration

And typed

log-queries

And save.

I found this solution at http://www.dslreports.com/forum/r23197832-Tomato-Enable-DNS-lookup-logging

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.