We are looking for a tool which can monitor traffic to social medsia sites from within an enterprise or a LAN environment. Are there any tools which let you monitor this, since we could infer such traffic at the network level (say HTTP) or by snooping for the API calls which are exposed by these social media platforms.


Yes, you can.

Since there are so many options how to do this and to what level of detail, the question is not really easy to answer in detail.

There is hardware that lets you monitor this, depending on the size of your network and your requirements. Normally the access will be logged on an IP basis. So for example if you want to track per-user access that might be using the same IP address, things get more complicated.

You can have a simple logfile where you then will have to find yourself which URL is a social media and which is not (facebook for example uses several different top level domains). Or on the other extreme, you can subscribe to a service that will automatically classify also newly created websites of certain types as "social networks". This is specially used for companies that want to block certain types of websites from being used.

For your specific personal usage, you will have to give more information as to how many users you have, what kind of information you want (access, data transferred, time spent per site, per user, per IP etc) and what kind of money you want to spend for that.

more information on URL logging and the meaning of a log entry

Getting URL logs: Depending on what hardware you have, you might have already or can easily setup URL request logging. If you can tell what router and/or firewall you are using, this might give the answers already. You can setup network URL logging yourself with any router with this trick, but this might slow down your network traffic. So depending on your network traffic, it might be worthwhile to get a proper solution. One option might be also to use a linux based system with two network cards that simply sits in the middle between your LAN and WAN and runs the analysis there. That is a bit more manual, but the cost is as small as a simple cheap PC. You can also install software on every user's computer to monitor what they are doing.

Interpreting the logfile: A standard logfile will normally show you something like this:

[IP 1] [Time 1] [URL 1]

[IP 1] [Time 2] [URL 2]

This means that the a computer (that has the IP "1") accessed the URL 1 (Let's say "facebook.com" at time 1 (let's say 12:00). The same computer (same IP "1") accessed at time "2" (Let's say 20 minutes later) another URL, let's say a different facebook URL, such as a user profile.

What does this tell you? At the minimum, it tells you that from the same computer, someone opened facebook and then, went to copy something, work or do whatever, and then came back to the browser 20 minutes later and clicked on a link on the facebook page. Nothing else.

It however also could be that the user wrote a message on facebook for 20 minutes (without clicking a link though or other requests), and then he read one the next page for 2 more hours after the second click. It is in this case impossible to say.

However: In the end you will realize that such a log entry is highly unlikely. People who work, will maybe open facebook once, check some messages and that is it. It will result in some clicks over 15 minutes, and then stop. People who do not work, will spend many more clicks and time on facebook, reddit, etc etc. If you would filter the lines of business relevant websites out of the logfile and see that a user opened 2000 other links within his working day, you have an issue.

In the end, what you have to take care about is that no logfile and more so no money spent to get that logfile will help you unless you analyze it properly and then look at the data, too - and then take consequences.

I made the experience in a larger company (6k+ computer users) where the decision was done against such a log analysis software because people realized that nobody will take the time and really look at it on a per-user basis to take action against users for browsing too much. The only thing that was done was to monitor the data throughput of each service (youtube for example) since the data transferred caused the network to be slow. So Youtube and other video services was blocked. There was also a block for certain types of website (gambling, porn etc) - since there are more serious issues at hand if a user watches porn in the office as opposed to be simply lazy. Facebook was not blocked because the opinion was that it is not possible to make people more productive by blocking facebook - or anything else. People have been lazy before facebook too. IF you block facebook, they will be unhappy and will find other ways to spend their time instead of working. Nobody would win. Instead it is more important to make sure people are managed and motivated properly so they do not spend all their time on facebook.

Btw here is another short article on network analysis.

  • I would like to identify user id handles (e.g. facebook id or twitter id) of the users who are using on a periodical bais.
    – Samuel
    Jan 24 '13 at 4:39
  • We are more interested in monitoring what messages they are posting in Facebook, Twitter. We will be able to isolate once we have their id(s)
    – Samuel
    Jan 24 '13 at 5:22
  • @Samuel actually I think this is a different question. I would first layout your network infrastructure in a question a bit more so people can understand if you talk about 10 or 1000 users. I would then ask the concrete question how you can catch FB and twitter messages from these users. What I can tell you right away however that this is a completely different scale than just knowing which URL they connect to. You will have to read every packet. On top of that, FB uses encryption (SSL) which makes it impossible. You will also face some criticism regarding privacy and likely legal issues.
    – uncovery
    Jan 24 '13 at 6:33
  • @Samuel your current question "How to measure" would be right if you wanted to know how only much time people spend on certain websites. If you really want to know the content of messages, you need much, much more advanced hardware and software.
    – uncovery
    Jan 24 '13 at 6:36
  • Ok assuming I wouldn't know who it was. Is there a way to know how much time a certain IP spent on a social media site (say Facebook or Twitter).
    – Samuel
    Jan 24 '13 at 7:55

There are numerous products that offer the monitoring functionality you request e.g. Netnanny, OpenDNS, Netintelligence, ...

See also: alternativeTo

Not the answer you're looking for? Browse other questions tagged or ask your own question.