Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to know how to monitor users' outgoing http requests. I've got a FreeBSD 8.1 server, and I would like to get an output like this for http requests:

source MAC address or IP address → destination IP address.

I don't need any other information, just the source of the request and the destination.

share|improve this question
If you are really looking for the source IP or MAC address, then this is best logged at the router. Do expect extraordinarily large logs: the front page of amazon.com sends 95 separate documents, whitehouse.gov sends 55, and cnn.com over 150. – msw Jul 8 '14 at 13:33
tcpdump src host and dst port 80 or dst port 443 – Ramesh Jul 8 '14 at 13:34
Why do you need the MAC address anyways? – Bratchley Jul 8 '14 at 14:15
I need MAC address to localize easier the users. And yes, it's quite a big log like msw said. – AttilaBorbás Jul 9 '14 at 6:58
Another option is to use iftop if you don´t need to inspect packet-per-packet: iftop -i yourlan0 -N -P -f "src host ip_src and dst host dst_ip" = freebsd.org/cgi/… – nwildner Jul 9 '14 at 11:08

I think the easiest would be to use a transparent HTTP proxy (like squid) which logs the requests.

Redirect all outgoing HTTP requests to that server. To get the MAC-Adress either correlate with the DHCP servers lease file or use something like arpwatch, if the users assign the IPs themselves.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.