Actually I am making an Log Analyzer for downloads on a network by different users.So i want to know who downloaded what in a same network.I know SSL packets cannot be sniffed but I want only downloads that is not secured by SSL.
If you have a switch that support Port Mirroring you could do the following way
- Create a mirror port of your uplink, or if you have multiple level of switches(core, distribution, dep) make a mirror of your internet facing port to another port of this switch.
- Install ntop on your *NIX system. It is a pretty good tool to create statistics about traffic.
Other ways you could do this:
- Install ntop at your firewall, if the internet link is directly connected to it
- Configure sFlow/NetFlow on your router to redirect traffic information to your ntop server.
tcpdump is a tool for packet analyze/inspection, it will be harder to display URL, times of download and other things that are more "high-level" and more usefull to your reports.