up vote 0 down vote favorite
share [g+] share [fb]

I have a need to find out how to log all Internet traffic of all users on a network that uses a Windows Server 2008 machine to provide Internet access to the entire network. I know, since this server provides Internet access to all machines on the network, that all Internet traffic is funneled through this machine.

What programs are available for logging all Internet traffic of all network users? Also, is there a feature built into Windows Server 2008 that allows this?

link|improve this question
Belongs on serverfault.com – Mehrdad Jun 14 '09 at 19:16
A little more detail: What kind of info do you need? Just websites visited? Connections? Every packet? – Josh Brower Jun 15 '09 at 3:03
Also, just as a reminder: make sure you have written permission from HR, etc... – Josh Brower Jun 15 '09 at 3:04
Are you authorized to do this? – dr.pooter Jun 15 '09 at 5:30
If only ServerFault recognized that I created this question on StackOverflow and IT moved it here. I CAN'T EDIT THE QUESTION!! – Chris Pietschmann Jun 15 '09 at 17:44
show 1 more comment
feedback

5 Answers

up vote 1 down vote

Network Monitor 3.3 is probably your best bet.

link|improve this answer
feedback
up vote 0 down vote

I'm not aware of such a feature built into Server 2008. There is a product called Internet Access Monitor that appears to do what you want:

http://www.redline-software.com/eng/products/iam/

It is a commercial product however.

link|improve this answer
feedback
up vote 0 down vote

I think you could probably do this with Squid. I am running it as a web filter and cache on a Windows machine.

It's open source and very configurable.

http://www.squid-cache.org/

EDIT - not sure why I am down-voted here. Running Squid as a proxy and pointing all other machines it would accomplish this.

link|improve this answer
I didn't down-vote, but A> Only if "everything" is web based, and B> everything is preconfigured to use squid as the proxy. I am guessing that this is not the solution set being looked for. – David Mackintosh Jun 15 '09 at 3:16
I'd say a. squid is nto a windows utility (netmon is) b. question is not how to add a proxy but how to simply monitor traffic. – Jim B Jun 15 '09 at 3:21
Point taken..thanks for responding. Maybe I am just a big fan of Squid, but I think I would still recommend it. Its lite on resources and has been running on Windows for years. True that all machines would have to be configured to run through it. – cop1152 Jun 15 '09 at 3:33
I think SQUID is an excellent idea, though obviously we need to clarify whether the questioner wants all traffic or just web traffic. I too have used the Windows port of SQUID extensively and it's an excellent Windows web proxy, though admittedly configuring it can involve some head scratching. +1 from me. – John Rennie Jun 15 '09 at 7:38
feedback
up vote 0 down vote

Windows has an "Network Monitor" Windows component utility which can capture all network traffic. There are also tcpdump equivalents like WinDump.

link|improve this answer
feedback
up vote 0 down vote

If you want to capture all (there may be some things it misses, but I am not aware of any) traffic you can always use Wireshark. However keep in mind this will be a VERY detailed trace unless you know what paticular filters you are after (for example, just HTTP traffic?) in which case there may be more specific applications.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.