|
That's
exactly the scenario that works with an 'extra' instance of
ntop.
Using
the -B "ip and host 192.168.x.x"
means
that only traffic to/from that user will be monitored. Turn on sticky
hosts option too, since s/he shouldn't be hitting enough sites for the memory
usage to kill you.
Then
all you need to do is connect to that instance and look at the remote sites
s/he's visited. The basic web pages give you the totals, while the rrd
graphs give you the usage by host over time.
If
it's all on lunch hour, fine. If it's not, well, then ...
-----Burton
I
see that paper now -- I hadn't even been to ntop's sf.net site yet, so that's
probably how I missed it (never saw it). As far as ALWAYS tracking
/ logging where veryone has gone, that's not what I need. Here is a
scenario:
Manager X comes to me and says "We need to find out what kind of
Internet browsing activity employee Z is doing on a regular basis -- we
believe employee Z is wasting a lot of time at site X and not getting work
done." So I start tracking / monitoring the host of this user for a few
days to be able to provide a record of what this user has been doing / where
they have been going.
Pretty much that Is all that is needed -- nothing more. I care
not to keep a full detailed history of all hosts at all times -- even for a
week or so. I realize that the only real feasible way to track someone
is to set it up on request, and only for a definite period of time given how
logs would eventually get way out of hand.
I'll
read over this rrd paper and try to see if I can pull whatever details I can
from it to do what I need to.
How about reading the documentation that's available? I know
there's not much, but one of the few things that DOES exist is the "ntop and
rrd" paper at SourceForge.
As
to the other, well, ntop is a network traffic monitor, not a forensic
tool. If you think about it, it takes enough storage now to hold a
single dimensional (sent/received) view of the hosts - can you
imagine if we had to store the nxn matrix??? We do that for the local
hosts and it's a large chunk of the per host storage.
If
you want to do forensics, there are tool$$$s that store a days or weeks
traffic and let you dig into it. But even then you need to know you
want to monitor - I've never met or heard of anyone who could afford to
archive the Gbs of data that flows over a network just in
case...
-----Burton
Just to follow through with this. So as it is, NTOP has no
way to dynamically 'tag' a host on the fly for further scrutiy -- ie: to
monitor. The only way this can be done is to manually start another
NTOP process with said flags pointing at the host that needs to be
monitored? Seems rather... cumbersome. I'm sure it works fine,
but having to visit the NTOP machine each time to start up a process to
follow a hosts activity seems a bit involved... but if that's it--that's
it.
On that note, if this is what has to be done, rrd graphs is
metioned, which I know not how to use at all. Where can I get more
details on how to use rrd graphs? I would also not mind getting more
information on the LastSeen plugin, which I have enabled but cannot seem
to make work / make sense of. If this isn't relevant to this thread,
I'll ask about that eslewhere.
Thanks
Erik Spigle
Jesse:
I emailed Luca regarding this, but never received a
response. I may attempt to do this again. So to answer
your question, no, I never did get an answer. If I do get a
response back that I can relay to you, I will doso. Likewise,
please let me know if you find out anything
yourself.
Thanks!
Erik Spigle
Hi,
This is my first post to
the list so i apologise in advance if this is the wrong place to
ask.
I've found a message that is asking this same question,
the message was ---->
.. From: Erik
Spigle
.. Subject: [Ntop] Possible to produce reports on
host Internet history?
.. Date: Tue, 06 Jan 2004 14:38:16
-0800
In the post
Luca replied asking Eric to email him in regards to this, I was
wondering if the answer could be posted to the list or emailed to me
if at all possible.
Basicaly what i need to know is how can i
produce a report showing internet browsing usage by users on our
network.
Thanks,
Jesse
Hurford
|
