0

We use Netflow to control traffic, when i want to resolve the IP addresses from netflow's outside destinations list, i get local google cache server's IP address, never the web sites that users has visited, how do i find out the actual web site that user has visited?

closed as off-topic by Ron Maupin Jan 13 at 0:23

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "NE is a site for to ask and provide answers about professionally managed networks in a business environment. Your question falls outside the areas our community decided are on topic. Please visit the help center for more details. If you disagree with this closure, please ask on Network Engineering Meta." – Ron Maupin
If this question can be reworded to fit the rules in the help center, please edit the question.

1

The web site URL is not a network or transport-layer entity. It is visible only at the application layer and may be encrypted anyway. Don't forget that a URL can resolve to many IP addresses, and a single IP address may be used for multiple web servers.

The most reliable way to understand what sites are visited is to use a web proxy.

  • That makes sense, could you recommend any opensource web proxy? – tyler durden Jul 25 '16 at 11:50
  • @tylerdurden, product or resource recommendation are explicitly off-topic here. – Ron Maupin Jul 25 '16 at 13:55
  • There are also appliances that allow packet capture throughout your network (OK, anywhere a capture sensor is installed). This has the advantage of giving you more than just web traffic. Some may even do HTTPS proxy, which would allow you to see which web site HTTPS traffic is going to (and make you feel dirty for doing a man-in-the-middle attack). – Nanban Jim Jul 26 '16 at 21:41

Not the answer you're looking for? Browse other questions tagged or ask your own question.