Tag Info

New answers tagged

5

You are tackling this problem at the wrong layer. Literally, layer 4 when you should use layer 7. Don't log TCP connections in iptables. Instead, capture HTTP traffic and inspect the Host header in the requests that the clients are making.


7

I'm not sure i get the whole picture but since you are writing about websites i think you are using a tool that is not exactly suitable for the task. imho you are looking for that information (the visited domain name) at the wrong level: you should have a proxy and analyze its logs to gather that info. A proxy is 'near' the client and has the exact and ...


5

You cannot easily determine what the user typed into their browser's URL bar using just an IP address log: You can't tell if someone accessing 104.16.13.13 got there by typing aviation.stackexchange.com or tex.stackexchange.com (the best you can determine is that it's a CloudFlare IP address). In order to get the information you seek you would need to ...


0

I have this setup (or close to it) working currently, but with a few differences. Instead of CentOS, I am using a static route to catch traffic on port 80 to my pfSense gateway and redirect it to another pfSense based box running Squid. The difference with my setup, is when pfSense Squid is set to do transparent proxying, it listens for connections on port ...



Top 50 recent answers are included