Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am managing a network in a condominium. Right now, I am looking for a method for logging the users' activities without using a user login system. We have this login system not long ago, but people hate it. Some people have problems with Internet TV. Their boxes don't have any I/O port for Captive Portal. Some people want to use Internet on more than one machine simultaneously.

So I was thinking of removing logging in system, yet according to my country's government law, if there is an illegal activity from my building, I must be able to present the evidence that the illegal activity is from a room in a condominium.

In the case of someone doing illegal activities, what can I do here in order to know the user's identity without creating a user account? I know that this may sound contradictory, but I am just a rookie in networking. Is something like this possible or am I asking for the impossible?

[edit]Sorry that I was too brief the first time.

share|improve this question
    
Wait...how would you have users using your system without a login? Are you talking about something like a cafe' with anonymous web access? –  Bart Silverstrim Jun 12 '11 at 11:47
    
No, we are talking about a program on the server gateway that can manage networking. We can filter out P2P, etc. in our network without having users to log in. –  Karl Jun 13 '11 at 3:03
    
Are you in an environment where you CAN'T log them in, like a cafe' or other anonymous web access. –  Bart Silverstrim Jun 13 '11 at 11:20
1  
your only real option is to log based on physical interfaces. You have a drop running to a particular interface on your switch, you know who owns that drop, you know who to make accountable for traffic entering and exiting that interface. –  Michael Lowman Jun 13 '11 at 17:04
1  
Michael - you should post that as an answer –  Ziplin Jun 13 '11 at 17:11

2 Answers 2

up vote 1 down vote accepted

Your only real option is to log based on physical interfaces. You have a drop running to a particular interface on your switch, you know who owns that drop, you know who to make accountable for traffic entering and exiting that interface.

In a normal setup, you'll have one or more Ethernet lines running to each condo. The end of these, where the user plugs in, is usually referred to as a "drop". To implement this solution a managed switch or high-end router is needed. A managed switch allows the administrator to login via a command line or web interface and make configuration changes. Such switches have many options for logging and feature support, although using them requires some degree of technical expertise. The Cisco Catalyst family is a good example.

When I wrote that comment, I assumed you wanted logging of all traffic at Layer 3, corresponding to which IP addresses were accessed by which computers on which ports. If instead you want Layer 7 logging, you have a few more options.

Logging at Layer 7, the application layer, involves logging a specific protocol. This is only really feasible for HTTP. HTTP traffic can be logged by configuring Squid as a transparent proxy: you must modify routing tables on your main gateway (the host between your network and the internet) to redirect HTTP traffic from the condos to a separate Squid machine. Squid can then log the traffic (and process it, if desired) before sending it back to the gateway. You must configure the gateway to allow all traffic from the Squid machine to go directly to the Internet.

This transparent proxy solution may end up being rather resource-intensive; hence the use of a separate machine for your proxy. Squid must interpret and process all HTTP data being sent and received through the condos' computers.

The networking setup can also be a little tricky. It's important to evaluate your requirements and to create a maintainable system.

share|improve this answer

The first thing you would want to do is to break out each condo into it's own subnet. This will be the quickest way to easily identify what traffic is coming from what condo. You will then want to setup some proxy to log / filter traffic. Squid is the first one that comes to mind.

share|improve this answer
    
But if you set proxy, then people will still have to authenticate, no? –  Karl Jun 14 '11 at 6:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.