We use Netflow to control traffic, when i want to resolve the IP addresses from netflow's outside destinations list, i get local google cache server's IP address, never the web sites that users has visited, how do i find out the actual web site that user has visited?
Add a comment
|
1 Answer
The web site URL is not a network or transport-layer entity. It is visible only at the application layer and may be encrypted anyway. Don't forget that a URL can resolve to many IP addresses, and a single IP address may be used for multiple web servers.
The most reliable way to understand what sites are visited is to use a web proxy.
-
That makes sense, could you recommend any opensource web proxy? Jul 25, 2016 at 11:50
-
@tylerdurden, product or resource recommendation are explicitly off-topic here.– Ron Maupin ♦Jul 25, 2016 at 13:55
-
There are also appliances that allow packet capture throughout your network (OK, anywhere a capture sensor is installed). This has the advantage of giving you more than just web traffic. Some may even do HTTPS proxy, which would allow you to see which web site HTTPS traffic is going to (and make you feel dirty for doing a man-in-the-middle attack). Jul 26, 2016 at 21:41