Shell Script

[karthick01]

Hi ,

Im very new to shell scripting. In our office we use both Linux and Windows platform. We have internet connectivity. The gateway is 192.168.1.1 There is no monitoring tool for us. Im using a Linux machine with fedora 8. I wish to monitor that gateway. I want to get log that which ip address is passing through that gateway and which website is accessed.

I need to submit report regarding workstations and their Website access. Is there a way to do that in shell scripting or in any other scripting. Pls let me know about the command and syntax so that it would be thank full .
Thanks
Karthick

[Salem]

Isn't your gateway machine also capable of providing this logging information?

[DimaYasny]

do you only use iptables as NAT, or is there a proxy server there as well?

[eggi]

Hey there,

Isn't all your traffic going through that gateway to get out to the internet (NATted) and internally?

Your best bests are, as mentioned above, getting the information from the gateway device or a proxy (if you use one to restrict web acess), or setting up a machine or appliance in between the default router and your pipe out to the internet and capture the data there.

Probably, you'll be able to see all the packets going to the default gateway from most machines, but you won't have any way to determine their destination IP's unless you use snoop/tcpdump/ethereal and pick through those packets, which you'll have to sift through, I believe, pretty much everything flying around your network if all traffic not contained on a specific subnet uses that IP as its default gateway.

Best wishes to you,

Mike

[eggi]

Then again, quick thought, if you're stuck using your local machine, perhaps using tcpdump/ethereal/snoop, etc and filtering out all your internal subnets might do the trick (?)

, Mike

[karthick01]

Hi All ,

Thanks for everyone who replied to my thread.let me tell the setup. Its a normal setup. We dont NAT,Firewall,Proxy or domain. The gateway ip address we use to the workstation is the DSL modem LAN ip address.We just have a modem and that modem is connected to switch and all the workstations are connected to switch so everyone share the internet connection..

My machine is also one of the system among the workstation. even i browse through that gateway.

Can u please tell me how do i monitor the other workstation who browse through that gateway and i want to know the URL they are visiting.

Please guide me with the scripting command if possible with syntax.

Thanks
Karthick

[DimaYasny]

you can set some kind of spyware on those workstations, or get their browser history in some other way.

the proper way to do that is to set up a proper traffic counting gateway, using a proxy or mission specific hardware.

[eggi]

This is true,

In your described setup, you should be able to capture all network traffic from every machine on your network from the NIC on any computer on your network. As suggested, it's a good idea to put that on a dedicated system.

Best wishes,

Mike