Actually I am making an Log Analyzer for downloads on a network by different users.So i want to know who downloaded what in a same network.I know SSL packets cannot be sniffed but I want only downloads that is not secured by SSL.

1 Answer 1


If you have a switch that support Port Mirroring you could do the following way

  • Create a mirror port of your uplink, or if you have multiple level of switches(core, distribution, dep) make a mirror of your internet facing port to another port of this switch.
  • Install ntop on your *NIX system. It is a pretty good tool to create statistics about traffic.

Other ways you could do this:

  • Install ntop at your firewall, if the internet link is directly connected to it
  • Configure sFlow/NetFlow on your router to redirect traffic information to your ntop server.

Since tcpdump is a tool for packet analyze/inspection, it will be harder to display URL, times of download and other things that are more "high-level" and more usefull to your reports.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .