Ahhh, yes it does. I manage another site that uses SonicWall it is so nice. But they do not wat to make a major change but switching out the firewall and having the execs have to replace their VPN clients at home.
I am looking at a few packages that do packet capture the get the usage logs. Kevin Bilbee > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of John Tolmachoff > (Lists) > Sent: Wednesday, March 31, 2004 8:32 AM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] OT: Internet Usage Monitoring > > > FYI, SonicWall does capture the URL in the syslog logging. :) > > John Tolmachoff > Engineer/Consultant/Owner > eServices For You > > > > -----Original Message----- > > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > > [EMAIL PROTECTED] On Behalf Of Adam Lukasiewicz > > Sent: Wednesday, March 31, 2004 7:18 AM > > To: [EMAIL PROTECTED] > > Subject: RE: [Declude.JunkMail] OT: Internet Usage Monitoring > > > > Kevin, > > I completely understand your dilemma, we have seen this issue many times > > before. Many vendors including Cisco do not capture the URL in > the syslog > > so other methods are needed to monitor web traffic. I appreciate this > list > > and don't want to market our company on it, but we have developed a > > technology specifically for this purpose. Would you mind if I have > someone > > contact you off of the list to explain how we could help you with this > > issue. > > > > Adam Lukasiewicz > > Operations > > www.ongarde.com > > [EMAIL PROTECTED] > > > > > > -----Original Message----- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee > > Sent: Tuesday, March 30, 2004 6:06 PM > > To: [EMAIL PROTECTED] > > Subject: RE: [Declude.JunkMail] OT: Internet Usage Monitoring > > > > > > I called Cisco and the reason the 515s do not log the host name > is because > > the pix does not look at the data in the packet(s) for the host header > > information!!!! > > > > Kind of usless as a url looger. > > > > > > Kevin Bilbee > > > > > -----Original Message----- > > > From: [EMAIL PROTECTED] > > > [mailto:[EMAIL PROTECTED] Behalf Of Darin Cox > > > Sent: Tuesday, March 30, 2004 2:55 PM > > > To: [EMAIL PROTECTED] > > > Subject: Re: [Declude.JunkMail] OT: Internet Usage Monitoring > > > > > > > > > The Pix doesn't log the hostname...at least not the 515s we usually > > > work with....only the IP address. > > > > > > Darin. > > > > > > > > > ----- Original Message ----- > > > From: "Kevin Bilbee" <[EMAIL PROTECTED]> > > > To: <[EMAIL PROTECTED]> > > > Sent: Tuesday, March 30, 2004 5:47 PM > > > Subject: RE: [Declude.JunkMail] OT: Internet Usage Monitoring > > > > > > > > > I have to agree that is why I am asking this list with diverse > > > experience. My research to this point supports your comment. > > > > > > I am thinking about downloading the trial versions of Websense and > > > N2H2 to get a comparison and determine it the PIX integeration also > > > supplies the host name in the reporting. > > > > > > > > > Kevin Bilbee > > > > > > > > > > > > > -----Original Message----- > > > > From: [EMAIL PROTECTED] > > > > [mailto:[EMAIL PROTECTED] Behalf Of Matt > > > > Sent: Tuesday, March 30, 2004 1:20 PM > > > > To: [EMAIL PROTECTED] > > > > Subject: Re: [Declude.JunkMail] OT: Internet Usage Monitoring > > > > > > > > > > > > One caveat to the suggestions is that many smaller sites now share > > > > the same IP with host headers. If you can't capture the domain > > > > used, this information will be lost in those instances. I'm not > > > > sure that there is a reliable way to convert IP's to domains on > > > > static sites either since all that would seem to be available would > > > > be the reverse DNS entry which often times won't match the domain of > > > > the site in question. It would seem that to do this with accuracy, > > > > you would need some sort of proxy server to handle HTTP requests. > > > > Note that I'm not familiar with the other options suggested, but as > > > > usual, I 'think' I'm right about this :) > > > > > > > > Matt > > > > > > > > > > > > > > > > Kevin Bilbee wrote: > > > > > > > > >Management wants to do web usage mainitoring. They do not at > > > > this time want > > > > >to do blocking. We have a pix firewall that does what Cisco calls > > > > >URL logging but in relaity it does not log the url but the ip > > > address of the > > > > >server and the path on the server to the document being viewed. > > > > > > > > > >What they want is a log of client ip and url including the host > > > > name. They > > > > >also do not want to abandon the PIX. > > > > > > > > > > > > > > >Any one have any suggestions? > > > > > > > > > > > > > > > > > > > >Kevin Bilbee > > > > > > > > > >--- > > > > >[This E-mail was scanned for viruses by Declude Virus > > > (http://www.declude.com)] > > > > > > > >--- > > > >This E-mail came from the Declude.JunkMail mailing list. To > > > >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type > > > >"unsubscribe Declude.JunkMail". The archives can be found at > > > >http://www.mail-archive.com. > > > > > > > > > > > > > > > > > > > > > > -- > > > > > ===================================================== > > > MailPure custom filters for Declude JunkMail Pro. > > > http://www.mailpure.com/software/ > > > > > ===================================================== > > > > > > > > > --- > > > [This E-mail was scanned for viruses by Declude Virus > > > (http://www.declude.com)] > > > > > > --- > > > This E-mail came from the Declude.JunkMail mailing list. To > > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type > > > "unsubscribe Declude.JunkMail". The archives can be found at > > > http://www.mail-archive.com. > > > > > > --- > > > [This E-mail was scanned for viruses by Declude Virus > > > (http://www.declude.com)] > > > > > > --- > > > This E-mail came from the Declude.JunkMail mailing list. To > > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type > > > "unsubscribe Declude.JunkMail". The archives can be found at > > > http://www.mail-archive.com. > > > > > > --- > > > [This E-mail was scanned for viruses by Declude Virus > > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, > > just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe > > Declude.JunkMail". The archives can be found at > > http://www.mail-archive.com. > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, > > just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe > > Declude.JunkMail". The archives can be found at > > http://www.mail-archive.com. > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.JunkMail". The archives can be found > > at http://www.mail-archive.com. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
