monitoring web sites

[johnwarbo]

Hi guys,

can any one recommend a simple program i can run on a standard pc to monitor or log what website the users on our small network at work (20 users) acees, maybe with the website, which pc (host name/ip address or mac address), time when the site was accessed and for how long ?

as i think a couple of the users are abusing the times they go on the net and for how long

thanks for any advice or help

john

 

[juniper911]

I'd recommend ISA 2004 as that does everything you asked for, you can also control when users can web browse e.g. lunch time only. It takes a bit of configuration but you end up having much tighter control of your users web browsing.

I dont know of any products that are out for free you try though although I use k9 at home.

 

[lhuegele]

most any proxy server will also do.

Good luck,

 

[johnwarbo]

thanks guys, but i found a small program called bwmeter , it's really a packet sniffer, that can create the log file i wanted.

 

[kmcferrin]

The only thing that it isn't going to be able to get you is an accurate count of how long someone was browsing a certain site. You can log page requests sent from their browser, and you can log the pages that are returned, but once the data is in the browser you have no idea how long they're looking at it. For example:

I can go to a web site that hosts a lengthy article that takes me 30 minutes to read, but all you're going to see is the second or two of network activity when I requested the page and it was sent to me. Conversely, I can log into Gmail and then minimize the browser window. Gmail will continually refresh the page every 60 seconds or so all day long, even though I'm not looking at the page. But when you look at traffic logs you're going to see me hitting Gmail's site thousands of times over the course of the day.

Not only that, but most proxies log ALL "http get" requests, whether they are user initiated or not. So when you load a page, you'll see a log entry for each separate page element. For a lot of modern pages that can be a dozen or many many more elements, especially on pages with lots of graphical elements. So you may only hit "

http://www.yahoo.com"

once, but you'll see 20-30 page requests related to it. This can also make it look like the user is surfing a lot more than they are.

So in summary, logging page accesses can be useful, but most of the time the resulting logs will need A LOT of cleanup before they're really useful.

 

[JBruyet]

Excuse me as I jump in here but doesn't ISA come as a component of Windows server? I had an issue yesterday where I did a packet sniff and found someone had downloaded a tad over 100 megs of files from an "adult web site." Unfortunately the buffer had filled up and my sniffer didn't have any packets left from this site so I couldn't tell who it was.

Thanks,

Joe B

 

[kmcferrin]

No, ISA is a standalone product. It's Microsoft's attempt at having a Windows-based firewall/proxy server. Frankly, I think I'd use anything other than ISA.

 

[JBruyet]

Got it.

Thanks.

Joe B

 

[Johnpholland]

There is some freeware called Dans Guardian which you an download and install, it will monitor web traffic and maybe other stuff such as MSN, etc etc

Good Luck
John