1

I have a need to find out how to log all Internet traffic of all users on a network that uses a Windows Server 2008 machine to provide Internet access to the entire network. I know, since this server provides Internet access to all machines on the network, that all Internet traffic is funneled through this machine.

What programs are available for logging all Internet traffic of all network users? Also, is there a feature built into Windows Server 2008 that allows this?

Improve this question
5
  • A little more detail: What kind of info do you need? Just websites visited? Connections? Every packet?
    – Josh Brower
    Jun 15, 2009 at 3:03
  • Also, just as a reminder: make sure you have written permission from HR, etc...
    – Josh Brower
    Jun 15, 2009 at 3:04
  • Are you authorized to do this?
    – dr.pooter
    Jun 15, 2009 at 5:30
  • If only ServerFault recognized that I created this question on StackOverflow and IT moved it here. I CAN'T EDIT THE QUESTION!!
    – Chris Pietschmann
    Jun 15, 2009 at 17:44
  • To clarify, The main focus is on Websites Visited, but other stuff would be a bonus.
    – Chris Pietschmann
    Jun 15, 2009 at 17:45

5 Answers 5

Reset to default
2

Network Monitor 3.3 is probably your best bet.

Improve this answer
2

I think you could probably do this with Squid. I am running it as a web filter and cache on a Windows machine.

It's open source and very configurable.

http://www.squid-cache.org/

EDIT - not sure why I am down-voted here. Running Squid as a proxy and pointing all other machines it would accomplish this.

Improve this answer
4
  • I didn't down-vote, but A> Only if "everything" is web based, and B> everything is preconfigured to use squid as the proxy. I am guessing that this is not the solution set being looked for.
    – David Mackintosh
    Jun 15, 2009 at 3:16
  • I'd say a. squid is nto a windows utility (netmon is) b. question is not how to add a proxy but how to simply monitor traffic.
    – Jim B
    Jun 15, 2009 at 3:21
  • Point taken..thanks for responding. Maybe I am just a big fan of Squid, but I think I would still recommend it. Its lite on resources and has been running on Windows for years. True that all machines would have to be configured to run through it.
    – cop1152
    Jun 15, 2009 at 3:33
  • I think SQUID is an excellent idea, though obviously we need to clarify whether the questioner wants all traffic or just web traffic. I too have used the Windows port of SQUID extensively and it's an excellent Windows web proxy, though admittedly configuring it can involve some head scratching. +1 from me.
    – John Rennie
    Jun 15, 2009 at 7:38
1

I'm not aware of such a feature built into Server 2008. There is a product called Internet Access Monitor that appears to do what you want:

http://www.redline-software.com/eng/products/iam/

It is a commercial product however.

Improve this answer
0

Windows has an "Network Monitor" Windows component utility which can capture all network traffic. There are also tcpdump equivalents like WinDump.

Improve this answer
0

If you want to capture all (there may be some things it misses, but I am not aware of any) traffic you can always use Wireshark. However keep in mind this will be a VERY detailed trace unless you know what paticular filters you are after (for example, just HTTP traffic?) in which case there may be more specific applications.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .