It is planned to install a clean ubuntu server 18.04 on a machine with two network cards. One card will receive internet from the provider. The second is the local network through which users will access the Internet. It is required to keep logs - who visited which sites. It would be great if I could see the mac address of the device in the logs. I read about tcpdump and tcpdump -i INTERFACENAME -e to display data with a mac-address. But I can’t find anywhere else information on how to leave tcpdump working as a service. Logging should be kept constantly.

On another machine, I have mysql. There I enabled logging of all queries to the database. And the most pleasant thing - the logs are automatically broken by days and automatically archived. I wish it were here too.

Whatever it was, you need to quickly and easily set up logging in the easiest way. We just need logs. Even without mac addresses.

What can be used?

closed as too broad by Rui F Ribeiro, Toby Speight, Mr Shunz, user34720, Haxiel Apr 5 at 13:48

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Please make concise and objective questions, and if possible one of a time. I honestly doubt it is on-topic asking lenghty tutorials/step-by step instructions. There are whole books about those subjects. – Rui F Ribeiro Apr 4 at 9:53
  • I think you should try any Opensource Firewall like pfSense, Endian, etc. You will have a stash of tools configured there that will allow you to audit a good range of protocols. The task you are asking here is simply impossible to be done with one tool alone(tcpdump) and as Rui already said, will create a lengthy tutorial to create a full setup of all tools. – user34720 Apr 4 at 12:49

But I can’t find anywhere else information on how to leave tcpdump working as a service. Logging should be kept constantly.

If you want to keep tcpdump running in the background and write to a log file, you can do something like

tcpdump -i INTERFACENAME -e > /path/to/log.txt 2>&1 &

Keep in mind there will be a lot of lines so apply filters as required.

  • it will works after reboot? – n.osennij Apr 4 at 10:57
  • Add it as a startup script if you would like stackoverflow.com/a/29247942/2248259 – user2248259 Apr 4 at 10:59
  • fine. last question - how can I auto save logs by days. tooday - /path/to/log-2019-04-04.txt, tomorrow - /path/to/log-2019-04-05.txt and etc.? – n.osennij Apr 4 at 11:19

Not the answer you're looking for? Browse other questions tagged or ask your own question.