0

kindly help me How can I monitor "Web Activity" of standalone users/clients on WiFi/LAN without restricting them?

  • => Requirements:-

(1) Just want to monitor "The visited websites, HTTP, HTTPs, FTP, FTPs & Web Downloads"

(2). Users/clients should be in standalone or workstation means no "Active Directory & no user authentication".

(3). Users should have Admin rights on their Systems/Devices (e.g., Just like when we allowed someone to share our WiFi internet for their mobile devices or LAN internet for their laptops.)

(4). Avoid any type of installations on user/client end.

(5). Users can be on Windows, Mac, Linux & on "Any Mobile Device i.e, tablet or smart phone".

  • => Internet Provisioning:-

(1) LAN internet (with DHCP scheme) is provided by "Cisco ASA 5510" through Cisco switches catalyst 2970/2960.

(2). WiFi internet (with DHCP scheme) is provided by Huawei PTCL modem/router.

Improve this question
5
  • Unfortunately, questions for product or resource recommendations are explicitly off-topic here, as they are on most SE sites. You could try to ask this question on Software Recommendations.
    – Ron Maupin ♦
    Commented Oct 17, 2016 at 13:49
  • @RonMaupin Sir I've edit my question. Is it ok now?
    – Muhammad Imran
    Commented Oct 17, 2016 at 14:54
  • Does the Huawei have its own internet connection, or how does it connect to the rest of the network?
    – Ron Maupin ♦
    Commented Oct 17, 2016 at 14:56
  • @RonMaupin The device is of Huawei brand but internet is provided by local "PSTN" provider (named PTCL).
    – Muhammad Imran
    Commented Oct 17, 2016 at 14:59
  • Unfortunately, the Huawei is off-topic here, but you could probably use NetFlow on the ASA. You are going to need to spend some money for the collector and software to read the records.
    – Ron Maupin ♦
    Commented Oct 17, 2016 at 15:01

1 Answer 1

Reset to default
0

According to your requirements, probably the only way of monitoring web (HTTP[S], FTP[S] activity is using proxy server in transparent mode. You can redirect necessary traffic to the proxy using WCCP protocol.

For example Squid, Cisco WSA and others can be transparent to the user queries. Therefore, your proxy will be discovered immediately with SSL encrypted traffic, as proxy acts as legal Man-in-the-middle. It should decrypt traffic to talk to server on behalf of client and to talk to client on behalf of server.

Going into details of HTTPS handshake, proxy server should send the certificate to the client, as it's necessary to generate symmetric session keys. Proxy typically uses its own certificate authority (CA) to generate such certificate on the fly.

But the browser immediately fires the red warning because it doesn't trust it. To avoid these warning this CA certificate is often send to the users machines by means of Windows ActiveDirectory GPO, but your requirements No(2) and (4) doesn't allow to conseal this proxy.

IMHO, you can either

  1. monitor only notencrypted traffic
  2. force users to use your proxy by ADs GPO
  3. let them know that there is an intercepting proxy on the network and send them the CA certificate to trust it. They don't like this option I suppose )
Improve this answer
3
  • Thanks dear. Is there a way to monitor web activity using port-mirror on the switch end?
    – Muhammad Imran
    Commented Oct 18, 2016 at 11:53
  • Thanks dear. Is there a way to monitor web activity using port-mirror on the switch end?
    – Muhammad Imran
    Commented Oct 18, 2016 at 11:54
  • It's possible for nonencrypted traffic. Tools for that purpose are mentioned here
    – Avalerich
    Commented Oct 18, 2016 at 21:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.