4

How can I centrally monitor users' browsing habits using a Sonicwall tz205, and running on a windows network?

I am looking for a report that will show me LAN user's ip address and websites/services that they visit/use.

Improve this question

1 Answer 1

Reset to default
5

SonicWall/Dell solutions:

SonicWall makes two product, ViewPoint (included in the Comprehensive Security bundle license) and Analyzer, that aren't too expensive (~$200USD), and will do exactly what you wish in a very easy to use way.

If you don't want to invest, you may be licensed:

Take a look here: http://www.sonicwall.com/us/en/products/TZ_205.html#tab=resources

Referring to the administrators guide, interesting parts are:

  • page 99, 630 (Enabling packetmonitor checkbox)
  • Part 18
  • Part 20 (chapter 85)
  • Page 1368 (Dashboard > Real-Time Monitor and App Flow Monitor)
  • Page 1373 (ViewPoint)

Analyzing traffic flows might be of interest, but is much more robust/granular:

I use flow probe/generator (netflow/argus) and a free project called flow-inspector. This is not as simple as proxy logs.

Maybe watching DNS will help:

Not exactly what you were looking for, but monitoring DNS lookups is valuable. This can likely most easily be done by using something to parse logs produced by your DNS server.

Recommendation:

If you already haven't done so, I suggest restricting outgoing traffic by firewall policy, then filtering and tracking that traffic.

Improve this answer
3
  • thanks for the thorough answer. I looked in my licensing. I purchased the 01-SSC-4886. I haven't used viewpoint in a long time.. I think I last used it on a tz170 of soho3/4. I have to look through the manual, but at glance, there is no mention of it anywhere in the admin. It also seems that analyzer will need to be licensed seperately, but there is a trial.
    – steve
    Feb 8, 2013 at 16:17
  • 01-SSC-4886 = "SonicWALL TZ 205 Wireless-N Secure Upgrade 2-Year CGSS" (ref1, ref2). CGSS? Comprehensive Gateway Security Suite. You are licensed for ViewPoint. ViewPoint is discussed in the Admin manual on page 1373.
    – brandeded
    Feb 8, 2013 at 17:47
  • Thats what I thought. However I followed the instructions step by step. Under Log there was no viewpoint option. I called sonicwall tech support, opened a ticket and a tech told me to just install viewpoint 6, and then put it in the syslog. It through me off that the instructions on setting up viewpoint didnt match the screens that were being displayed in the firewall.
    – steve
    Feb 8, 2013 at 22:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .