Hi, On 08/18/2012 02:17 PM, Boonyawat Pattarachaichan wrote: > Hi, all > > log traffic : > I investigate log in file usr/local/pf/logs/access_log > > 192.168.2.11 - - [15/Aug/2012:12:17:05 +0700] "GET > /content/images/background.png HTTP/1.1" 200 2733 > "https://localhost.localdomain/captive-portal?destination_url=http://www.doolakorntv.com/"; > "Opera/9.80 (Windows NT 6.1; U; en) Presto/2.10.289 Version/12.00" > 192.168.2.11 - - [15/Aug/2012:12:17:10 +0700] "GET / HTTP/1.1" 307 292 > "-" "Opera/9.80 (Windows NT 6.1; U; en) Presto/2.10.289 Version/12.00" > 192.168.2.11 - - [15/Aug/2012:12:17:10 +0700] "GET > /captive-portal?destination_url=http://www.mthai.com/HTTP/1.1"; 200 6990 > "-" "Opera/9.80 (Windows NT 6.1; U; en) Presto/2.10.289 Version/12.00" > > this log can check client to destination url but check in registration > vlan (in captive-portal page) if user authenticate and change to vlan 1 > access to internet (ip 192.168.2.11(vlan 2) change to 10.30.254.129(vlan > 1)), Can i check user go to desination url in vlan 1? Could you spot me > for this direction?
You could use the iplog to correlate that information. mac <-> ip and time is stored there. However timing would be important especially if IPs are re-used often in registration. Cheers! -- Olivier Bilodeau [email protected] :: +1.514.447.4918 *115 :: www.inverse.ca Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org) ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ _______________________________________________ PacketFence-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/packetfence-users
