Re: Monitoring web traffic

in addition to said squid proxy, please consider blocking p2p traffic 
and also looking at ftp traffic.

in terms of 'how do i block p2p traffic' it is usually easier just to 
block everything and then allow (ie a whitelist) whats needed. this will 
have the added bonus of knocking some IM's on the head and viruses that 
may be churning out copies of themselves or even just ping flooding 
people at your expense.

oh yes, and block outgoing smtp from everything but your mail server.
if your email is outsourced, it may be a good practise to have a local 
outgoing smtp server, which then forwards all mail to your provider for 
delivery (it could deliver itself, but 'best practise' is to deliver 
with an MX. this saves you from email viruses and people sending 
stupidly large emails.


Dean

invisible ink wrote:
> Andre Kolodochka:
> 
>> I'd like to start monitoring our company's web traffic. We have certain
>> download limit, which was exceeded by quite a lot last month and I need to
>> know whether the traffic goes to Facebook/etc or legitimate websites
>> related to our business. At this stage I don't really need to know who
>> visited what website. I am more after the data which will tell me what
>> website/files took how much traffic from our quota each day.
>>
>> What would be the best way to approach this task and with what tools?
> 
> This is very much a slug@ question rather than a slug-chat@ question. :-)
> 
> I'd recommend using squid (web proxy) and calamaris (log analysis). You can
> either firewall everyone so they have to use the proxy, or if you don't want
> to make client changes, you can force them through squid using transparent
> proxying (a firewall change). Then you can review the logs using calamaris.
> 
> Make sure the staff know before you start reviewing the logs.
> 
> - ii
> 
-- 
SLUG - Sydney Linux User Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html