PPTP VPN monitoring web traffic URLs

Question

I setup a PPTP VPN server (pptpd) on Ubuntu 10.04 and need the ability to monitor URLs that are being accessed via the web browser (80/443). I was thinking of utilizing a proxy like Squid, but wanted to be sure there wasn't something I could more easily/efficiently setup (whether it be logging on PPTP or something else). I know I could log on the DNS portion of things, but I need to be more granular down to the URL being accessed. I thought a proxy like Squid might be a little more than needed because I do not really need to read/cache the actual content of the page or what is being submitted, but just the URL being accessed.

Josh

Answer 1

One easy to do it would be to analyze the raw http traffic on the VPN interface and extract the needed headers, like this:

tcpdump -nli ppp0 port 80 -w - -s 0 | strings | egrep -i '(GET|Host)'

You should be running this once per ppp device, of course. This isn't as exact or clean as it gets, but I thought it might be useful for you.

It only works for plain HTTP connections, though.

EDIT: Found a better one!

apt-get install dsniff
urlsnarf -i ppp0

It still doesn't work with SSL connections, of course. You have to go the proxy way if you need that as far as I can see.