2
3
I would like to monitor all traffic in my home network, and I believe that there is not much disk space in my router to record all that pass through. I could be happy enough if I could log only the HTTP domains accessed, or if I could save it externally.
Jader Dias
Posted 2012-02-06T22:50:17.793
Reputation: 13 660
2
Since everyone uses my router as an DNS server and Syslog was already enabled, all I had to do was go to
And typed
log-queries
And save.
I found this solution at http://www.dslreports.com/forum/r23197832-Tomato-Enable-DNS-lookup-logging
Jader Dias
Posted 2012-02-06T22:50:17.793
Reputation: 13 660
1
The closer I could get is to log all outbound or inbound connections in:
Then it will appear in the log like this
Feb 5 15:00:00 unknown user.warn kernel: ACCEPT IN=br1 OUT=vlan2 SRC=192.168.0.2 DST=61.61.61.61 LEN=52 TOS=0x00 PREC=0x00 TTL=127 ID=2973 DF PROTO=TCP SPT=51313 DPT=80 WINDOW=4096 RES=0x00 SYN URGP=0 OPT (010203B30203030101020302)
From the DST field I can guess the target domain using a reverse DNS lookup
Jader Dias
Posted 2012-02-06T22:50:17.793
Reputation: 13 660
Maybe some kind of cron job? Compress the log file with bzip and send it to somewhere via SCP? – Apache – 2012-02-06T23:04:33.627
@Shiki what log file? I haven't found any log file that contains the information I want in tomato. – Jader Dias – 2012-02-06T23:07:27.257
1Can you set it up to send to a SYSLOG server? Then you can have the server log, filter, etc. however you like - plus the Syslog Server probably has plenty of disk space. I'm not familiar with Tomato, but my D-Link router can do that. Note that on D-Link you have to go to a non-obvious place to get it to log sites accessed - perhaps something similar on your router. – yosh m – 2012-02-07T01:43:56.353
@yoshm Yes, syslog is already enabled – Jader Dias – 2012-02-07T14:10:42.440