Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to monitor all traffic in my home network, and I believe that there is not much disk space in my router to record all that pass through. I could be happy enough if I could log only the HTTP domains accessed, or if I could save it externally.

share|improve this question
    
Maybe some kind of cron job? Compress the log file with bzip and send it to somewhere via SCP? – Shiki Feb 6 '12 at 23:04
    
@Shiki what log file? I haven't found any log file that contains the information I want in tomato. – Jader Dias Feb 6 '12 at 23:07
1  
Can you set it up to send to a SYSLOG server? Then you can have the server log, filter, etc. however you like - plus the Syslog Server probably has plenty of disk space. I'm not familiar with Tomato, but my D-Link router can do that. Note that on D-Link you have to go to a non-obvious place to get it to log sites accessed - perhaps something similar on your router. – yosh m Feb 7 '12 at 1:43
    
@yoshm Yes, syslog is already enabled – Jader Dias Feb 7 '12 at 14:10

The closer I could get is to log all outbound or inbound connections in:

  • Administration > Logging > Connection Logging > Inbound or Outbound > If Allowed by Firewall

Then it will appear in the log like this

Feb 5 15:00:00 unknown user.warn kernel: ACCEPT IN=br1 OUT=vlan2 SRC=192.168.0.2 DST=61.61.61.61 LEN=52 TOS=0x00 PREC=0x00 TTL=127 ID=2973 DF PROTO=TCP SPT=51313 DPT=80 WINDOW=4096 RES=0x00 SYN URGP=0 OPT (010203B30203030101020302)

From the DST field I can guess the target domain using a reverse DNS lookup

share|improve this answer
up vote 1 down vote accepted

Since everyone uses my router as an DNS server and Syslog was already enabled, all I had to do was go to

  • Advanced > DHCP / DNS > Dnsmasq Custom Configuration

And typed

log-queries

And save.

I found this solution at http://www.dslreports.com/forum/r23197832-Tomato-Enable-DNS-lookup-logging

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .