I'd like to know how to monitor users' outgoing http requests. I've got a FreeBSD 8.1 server, and I would like to get an output like this for http requests:

source MAC address or IP address → destination IP address.

I don't need any other information, just the source of the request and the destination.

  • 3
    If you are really looking for the source IP or MAC address, then this is best logged at the router. Do expect extraordinarily large logs: the front page of amazon.com sends 95 separate documents, whitehouse.gov sends 55, and cnn.com over 150. – msw Jul 8 '14 at 13:33
  • tcpdump src host and dst port 80 or dst port 443 – Ramesh Jul 8 '14 at 13:34
  • 1
    Why do you need the MAC address anyways? – Bratchley Jul 8 '14 at 14:15
  • I need MAC address to localize easier the users. And yes, it's quite a big log like msw said. – AttilaBorbás Jul 9 '14 at 6:58
  • Another option is to use iftop if you don´t need to inspect packet-per-packet: iftop -i yourlan0 -N -P -f "src host ip_src and dst host dst_ip" = freebsd.org/cgi/… – user34720 Jul 9 '14 at 11:08

I think the easiest would be to use a transparent HTTP proxy (like squid) which logs the requests.

Redirect all outgoing HTTP requests to that server. To get the MAC-Adress either correlate with the DHCP servers lease file or use something like arpwatch, if the users assign the IPs themselves.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.