up vote 0 down vote favorite
share [g+] share [fb]

I'm running RRAS, DHCP, and DNS servers on my Windows Server 2008 box, and it's current purpose is being a NAT firewall and router.

I would like to be able to have the server email me a log, daily, of outgoing and incoming network traffic. I know this can balloon to be huge, but this has to be done for legal purposes. I've seen people do this by attaching to an event, but I'm not sure if there's an event fired when a new day begins (as in returns to 0100 hours).

I might be using the wrong terminology, so this is basically what I'd be looking for

{Timestamp} {local IP address} connected to {External host or IP}.

It doesn't need to be strictly this format, but the information I require, at the least, is a timestamp, the local ip making the connection, and the external host or ip it established a connection to.

This is a server at a fraternity, and the legal matter is notices from our ISP (Comcast) about notifications received from copyright holders on infringement of copyright. In these letters, the information they give is timestamp, torrent tracker, peer IP they connected to and our WAN IP at the time. Some hash information is also shown. We need to keep a log of Internet traffic so, in the event of actual legal action being pursued, we can show which person performed the infringement. If we can't do this, then the organization will need to take the hit.

link|improve this question
Get a web filter or some sort of proxy that logs this info for you. You don't want it emailed to you every day, all you need is to be able to query it when the need arises. – Ben Pilbrow Aug 29 '11 at 16:21
How are you going to correlate this information to the user? – joeqwerty Aug 29 '11 at 18:28
I'm going to have static IPs assigned to the MAC addresses of devices. Nobody there knows how to do things like MAC spoofing, so that's what I'm going to use for now. I'm learning more about SQL Server, so I may want to have a table defining MAC address and user names, mac addresses and IPs during a certain date range, and the IPs related with logging (but this DEFINITELY future thinking ). – Brandon Papworth Aug 30 '11 at 2:24
Oh and to Ben: Thanks, I was reading some about using the windows build of squid, which I'm familiar with on Linux. I may end up doing that if I can't find a way to do this with standard windows logs. – Brandon Papworth Aug 30 '11 at 2:25
feedback

1 Answer

up vote 0 down vote accepted

Thanks to Ben, I decided on using a squid proxy to log the data I was looking for. I will continue getting myself familiar with how Windows Server logs traffic to see if there's a script I can write up to extract this information from the RRAS NAT.

If squid turns out to not offer me enough information, I may do something crazy like use hyper-v to run pfsense and log from there (but this may cause some security issues).

link|improve this answer
There is none. RRAS is not meant t obe a traffic counter. I was on the same boat as you, I retired my RRAS VPN setups a year ago and got my hand on a handfull of Mikrotik Routers. Never looked back. – TomTom Aug 30 '11 at 6:08
I would love to have a router like that. Sadly, our funds and needs necessitated making one unit. I'll make do with writing a nice script to do what I want, and I'll make sure to post it on the Internet. Thanks for the comment! – Brandon Papworth Aug 31 '11 at 0:25
Funds? I Paid less than 60 USD for mosst of my Miktrotik units. – TomTom Aug 31 '11 at 4:41
Oh I didn't realize how cheap those are. If it would be able to handle 30+ users with some serious load, then I'll definitely look in to it. – Brandon Papworth Aug 31 '11 at 8:58
30+ users I would trya 450G - a little more expensive. I use a 450G for my office , 20mbit with VPN - a little crowded at times. My appartement has a 350G and my data center a 600USD or so 1200AH doing the core routing. All fully QOS - so a full line does not delay remote desktop etc. THere is a HUGH difference, especially if you put them on both sides and let them QOS. – TomTom Aug 31 '11 at 9:44
show 2 more comments
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.