0

kindly help me How can I monitor "Web Activity" of standalone users/clients on WiFi/LAN without restricting them?

  • => Requirements:-

(1) Just want to monitor "The visited websites, HTTP, HTTPs, FTP, FTPs & Web Downloads"

(2). Users/clients should be in standalone or workstation means no "Active Directory & no user authentication".

(3). Users should have Admin rights on their Systems/Devices (e.g., Just like when we allowed someone to share our WiFi internet for their mobile devices or LAN internet for their laptops.)

(4). Avoid any type of installations on user/client end.

(5). Users can be on Windows, Mac, Linux & on "Any Mobile Device i.e, tablet or smart phone".

  • => Internet Provisioning:-

(1) LAN internet (with DHCP scheme) is provided by "Cisco ASA 5510" through Cisco switches catalyst 2970/2960.

(2). WiFi internet (with DHCP scheme) is provided by Huawei PTCL modem/router.

5
  • Unfortunately, questions for product or resource recommendations are explicitly off-topic here, as they are on most SE sites. You could try to ask this question on Software Recommendations. – Ron Maupin Oct 17 '16 at 13:49
  • @RonMaupin Sir I've edit my question. Is it ok now? – Muhammad Imran Oct 17 '16 at 14:54
  • Does the Huawei have its own internet connection, or how does it connect to the rest of the network? – Ron Maupin Oct 17 '16 at 14:56
  • @RonMaupin The device is of Huawei brand but internet is provided by local "PSTN" provider (named PTCL). – Muhammad Imran Oct 17 '16 at 14:59
  • Unfortunately, the Huawei is off-topic here, but you could probably use NetFlow on the ASA. You are going to need to spend some money for the collector and software to read the records. – Ron Maupin Oct 17 '16 at 15:01
0

According to your requirements, probably the only way of monitoring web (HTTP[S], FTP[S] activity is using proxy server in transparent mode. You can redirect necessary traffic to the proxy using WCCP protocol.

For example Squid, Cisco WSA and others can be transparent to the user queries. Therefore, your proxy will be discovered immediately with SSL encrypted traffic, as proxy acts as legal Man-in-the-middle. It should decrypt traffic to talk to server on behalf of client and to talk to client on behalf of server.

Going into details of HTTPS handshake, proxy server should send the certificate to the client, as it's necessary to generate symmetric session keys. Proxy typically uses its own certificate authority (CA) to generate such certificate on the fly.

But the browser immediately fires the red warning because it doesn't trust it. To avoid these warning this CA certificate is often send to the users machines by means of Windows ActiveDirectory GPO, but your requirements No(2) and (4) doesn't allow to conseal this proxy.

IMHO, you can either

  1. monitor only notencrypted traffic
  2. force users to use your proxy by ADs GPO
  3. let them know that there is an intercepting proxy on the network and send them the CA certificate to trust it. They don't like this option I suppose )
3
  • Thanks dear. Is there a way to monitor web activity using port-mirror on the switch end? – Muhammad Imran Oct 18 '16 at 11:53
  • Thanks dear. Is there a way to monitor web activity using port-mirror on the switch end? – Muhammad Imran Oct 18 '16 at 11:54
  • It's possible for nonencrypted traffic. Tools for that purpose are mentioned here – Avalerich Oct 18 '16 at 21:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.