Ask Slashdot: Best Way To Monitor Traffic? 338
First time accepted submitter Shalmendo writes "My client needs to monitor traffic on his LAN, particularly going out to the internet. This will include websites like Facebook, Myspace, and similar, including from mobile devices. So far, based on the network education I have, I've concluded that it might be best to get a tap (And some kind of recording system with wireshark, probably a mini-barebone), or replace the existing Linksys router with a custom built mini barebone system with linux routing software and appropriate storage capacity etc to record traffic internally. (either way it looks like I will need to put together a mini barebone system for some purpose) My client is trying to protect his family from scammers and other unsavory types, and isn't savvy in this matter, so i'm doing it for him. What I need is a way to record the traffic at a singular point, like modem/router areas, or similar, and a way to scrape out Facebook, Myspace, and other messages. It also appears that the client's family is using iPhones and some game called 'words' which has message capability. Is it possible to scrape messages out of that game's packets, or are they obfuscated? Can I write a script? What software would you recommend? Linux routing OS? Can we sniff packets and drop them on the internal hard drive? or would a tap be better? How do I analyze and sort the data afterwards? my client needs easily read evidence (Such as text or screenshots) he can use as proof in discussion with his family to try and intercede in any potentially harmful transactions. In other words, how can I Achieve this goal? I have basic and medium training in computer networking, so I can make my own cables and such, but I've never worked on this exact kind of project before, and thought it might be better to query slashdot instead of do my own research from scratch. After days of discussion with the client, it's not plausible to put monitoring software in the devices on the network (due to legal issues and a few other factors), so I concluded a network tap or other device would be the best way to capture and study what's going on."
a bird in hand (Score:5, Insightful)
Or maybe go and buy an internet security hardware appliance like Sonicwall or Watchguard and bill out 700 hours labor. It will take you less time to install one than writing that horrific maligned essay you chose to sully our pages with.
Re: (Score:2)
Completely agreed. How did samzenpus decide this of all submissions should make the cut? The submitter is clearly quite uninformed and the question is far out of line with the thinking of the Slashdot community, even if it were reasonably formulated.
Next, please.
Re:a bird in hand (Score:5, Insightful)
It generates nerd rage and plenty of comments. This isn't a serious question at all. This guy is yanking our collective chain or he's kind of out of his depth. As others have noted, this idea is both unpleasant and pretty heavy work. Samzenpus, would you like to use any of the following as future Ask Slashdot submissions?
A client has approached me to develop an MMO, with clients for Windows and Linux. I'm pretty good with HTML and have made some Star Craft maps. What language should I learn for writing the MMO? I heard that Warcraft is written in sea plus plus. Would Linux be good for hosting the game?
I've been repairing cars since I was a kid, and I've been asked to visit the ISS to perform some repairs to its solar arrays. Rather than attend college and develop sufficient experience in more down to earth jobs, I'm asking Slashdot for some advice on how I can do this? What kinds of bolts do they use on those things? I have a pretty good socket set from Sears that's served me well fixing up cars.
Sorry dude, I blame Samzenpus more than the submitter. This question is so horribly out of place and is practically inviting a stream of "let me google that for you" responses and flames.
Re: (Score:3)
Re:a bird in hand (Score:5, Informative)
www.cloudmeter.com
SaaS packet sniffing with reporting.
Put a client on your network and then tinker to get the data you want.
Re: (Score:3)
-100 for Sonicwall. They are total crap. Maybe they have a place in the SMB market, if that market is full if people who hate having money and enjoy buying bad things.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
What is this based on? They seem to get the job done pretty well all the way on up to multiple gigabit WAN links.
Ahmadinejad? (Score:5, Funny)
Is that You?
Re:Ahmadinejad? (Score:5, Insightful)
Exactly. Either the "friend" is actually an oppressive government or a guy with some serious problems. Tell him it's not possible. Even if it's possible, it's a bad idea, possibly illegal. Then go take an Ethics class.
Re: (Score:3)
But as a technical problem I find it interesting. Don't ruin the beauty of the thing with morality.
Re: (Score:2, Funny)
But as a technical problem I find it interesting. Don't ruin the beauty of the thing with morality.
That's what my soon-to-be mistress said.
The wheel has already been invented! (Score:4, Informative)
Okay, you find it interesting. Look at any corporate Firewall and monitoring system and you have your answers. Hell I have an O'Reilly book from the very early 90s on TCP/IP security that covers all of the topics you need to know. The technology is nothing new, the only real variations are in how the logs are stored and parsed.
Re: (Score:2, Insightful)
Exactly. Either the "friend" is actually an oppressive government or a guy with some serious problems. Tell him it's not possible. Even if it's possible, it's a bad idea, possibly illegal. Then go take an Ethics class.
Or maybe it's a father who wants to monitor what his kids are doing. You might disagree with that, but as long as he's not beating his kids, how he raises his family is none of your business.
This guy wants to secure his home network. A secure network is a good thing. I'm sure you'll say that this is monitoring, not security. Well, how do you know if you've properly secured your network without monitoring it?
Re: (Score:2)
Re: (Score:3)
If dad want to monitor his kids, the best way to do that is to ask them. That is, what a father supposed to do. Sneaking for "bad stuff" means there's no confidence in the children. In that case, the family is already in-secure no matter what are you doing with the network. Don't try to sell family problems as a reason for monitoring. It just doesn't figure.
Yeah, because children NEVER lie to their parents. We are all live in a "Leave it Beaver" world.
I find it sad that whenever a "video game rating" or a "require ID to purchase violent games" article comes up, I see post after post about how it's the parent's responsibility to monitor what their kids are doing. Now here is someone who wants to monitor what his kids are doing electronically, and he's hammered for it. Again, you don't have to like it, but it's a parent's job to know what goes on his/her hous
Re: (Score:2)
Re: (Score:2)
and b) have to let you know the password. It's a far simpler solution than monitoring network traffic, as you say.
That's brilliant. Then you just turn them into the FB (c)ops for sharing their password and get their account shut down.
Re: (Score:2)
That doesn't mean I didn't block the crap on the Sci Fi network for a while. But he's an adult now, so no filtering for him.
Re:Ahmadinejad? (Score:5, Insightful)
What most try to point out is that this approach is really just looking at the internet, being afraid, and applying the biggest hammer possible to the situation when it really will not do much good at all. Teaching your kids right from wrong, as crazy as that sounds, is a LOT easier than not teaching them anything, throwing them onto the internet, and then trying to filter the "wrong" out and/or observe them doing wrong and punishing them (i mean "interceding") later.
Example 1: the clueless submitter asks about iphone apps, clearly has no idea what they even are, and completely overlooks the fact that whenever the kid/spouse/slave/whatever is out of the house, the fancy pants record-it-all box will have NO effect at all. This "project" has FAIL written all over it, for so many reasons.
Re: (Score:2)
I really like the saying I heard somewhere once: "It's easier to world-proof the kid than kid-proof the world"
Re: (Score:3, Insightful)
Not until the kids start voting and don't understand why anyone would have a problem with constant monitoring of all communication. Then they're everybody's business.
You can screw up a kid without beating him. Letting them know off the bat that you don't trust them in the least bit is one way to start. Once you've erode
Re: (Score:2, Interesting)
Or maybe it's a father who wants to monitor what his kids are doing.
Judging by summary writer's admission that beyond making patch cables, he doesn't know networking from a cow fart, I would consider this an accurate assumption.
Bad call, chief.
Re: (Score:2)
Ask /.ing this? It might well be the worst call ever.
Asking /b/ might be worse.
told "the road goes this way" (right into a brick wall), forcibly hurled into the ditch, pissed on, and buried under a pile of severed donkey penises that someone (quite inexplicably) had close by.
But is this is the response you expect at /., then I guess they're about the same.
Re:Ahmadinejad? (Score:4, Insightful)
This sounds more like someone is planning for a divorce.
Re: (Score:2)
Re: (Score:3)
You are either ignoring or not respecting the rights of people on your network, or you are a religious nutjob trying to filter the world to people on your network. Neither of which should be done.
As the GPP said, go take an ethics class, as this is probably highly unethical.
If you consider it unethical, then it's up to you to not help them. Don't write monitoring software, don't install it, don't support systems that use it, don't buy from companies that sell it. And you might even decide not to help someone who just works with clients like these.
But a different person might consider it ethical. For example, they might be a religious nutjob of the same cult. They can each help each other out, writing monitoring programs, building monitoring boxes, whatever. And consider t
Re: (Score:2)
Given the amount of case law that was basically formulated to address the "Employee is dicking around on facebook, doesn't like the fact that Network caught them at the IDS/Firewall/etc." case, it might well be legal to tap somebody under those conditions; but it's hard to make the case that it is ethical to tap somebody on the wire when the
Re: (Score:2)
What I inferred from the summary was that this guy has relatives in his house who are being scammed on the internet and needed some proof to help educate them.
Re: (Score:2)
That is what I read in the summary, not what I inferred.
Re:Ahmadinejad? (Score:4, Informative)
Re: (Score:2)
Exactly. Either the "friend" is actually an oppressive government or a guy with some serious problems. Tell him it's not possible. Even if it's possible, it's a bad idea, possibly illegal. Then go take an Ethics class.
I like how he concluded that installing monitoring software on the endpoint devices has "legal implications" as if his family is not really on board with the plan, then waves his hand over simply listening/recording EVERYTHING as if that is magically OK. Messages in words with friends? Shit, you better be recording the words they play, too. You wouldn't want your teenage daughter seeing "COCK" get a triple word score when she is playing against billybuddy99 on the interwebs...
using iPhones... (Score:5, Funny)
You're going to need to install your scripts on the Verizon / AT&T point of presence to handle the iPhone / Words With Friends traffic molesting.
I think the NSA has the hardware in place, you'll simply need to rent some space on one of their servers.
Re: (Score:2)
It would allow HQ to see that IMEI XYZ appears to be accessing NSFW.com within 30 meters of the store at times not-so-coincidentally similar to those times when human-resource-peon Smith is scheduled for work; but I'd be pretty surprised if that
Re: (Score:2)
It might be an IMEI sniffer. It could tell corporate security "hey, a known shoplifter's phone just showed up in store #1234." I don't know about Canadian law, but in the U.S. that may not be violating privacy because it's not "intercepting a conversation", it's just listening to a broadcast of something the phone is already doing. Of course, even that tool could be abused. "Did Bob show up to work on time today? His phone's not there."
But being that it's Bell, they would have all that information anywa
Who is this (Score:5, Insightful)
'client'? And why does he need to know the content of every. single. message. that goes out on his network? Is this going to be like the talk with my kids when they say 'my friend has this girl he likes' kind of thing?
If you need to know what every message going out is, including the content of a (I assume) 'words with friends' game, maybe you should just unplug for a while and take a walk in the woods to clear your head. Then maybe speak to a psychiatrist for the paranoia issues.
Re: (Score:2)
Re:Who is this (Score:5, Insightful)
His "client" is obviously himself, he has serious trust issues and should probably seek professional help in dealing with those. His "client" isn't savvy in the matter of "protecting his family from scammers and unsavory types" yet he thinks that being able to crimp a patch lead is enough of a background to "tap" SSL encrypted sessions, breaching various computer misuse laws depending on your country (Wiretap Act in US, Computer Misuse Act / RIPA in the UK). Not only that, but he wants intelligent and monitoring of communications between two parties without their consent. All of this done with a script, with screenshots (that's desktop integration, mate) and then he wants to blow up his family by confronting them with this "evidence".
I think 4Chan just trolled Slashdot.
Re:Who is this (Score:4, Insightful)
I still think it is a trolling of the /. editors.
No one who knows how this could be accomplished would actually consider it at a home install network. Aside from being cost prohibitive, to defeat it all you need is an SSL proxy so that you can https to the proxy and from there go to the WWW. Thus this would not even be useful if the people being watched thought they were being watched.
-nB
Re: (Score:2)
When spying on your own family (you asshole!), you have access to client computers, and can install your own SSL certificates, or an outright keylogger. Common software can detect keyloggers and that can get you into trouble when shit hits the fan, so a SSL certificate with a proxy on the router, while being more Rube Goldbergesque, is safer.
(Sorry for potentially helping a home despot, but in order to be secure, you need to know what the enemy can do, so hiding this discussion wouldn't help.)
Cure the problem (Score:3, Insightful)
Take all their devices, and get rid of the internet if he cant control them. When my kids started staying up later than I wanted I just shutdown the router from 10:30 pm to 8:00 am back in the day. Besides if they have I smart phones they can just get off the lan and onto the carrier circumventing any controls you put on the lan.
Your client is a stalker? Or just the new Fritzl? (Score:5, Insightful)
Seriously.
Logging traffic is not going to stop someone from doing something stupid, like falling for a scam.
Education is.
Way overthinking this (Score:2)
Re: (Score:2)
one word answer: don't (Score:4, Insightful)
Fortigate will do what you need out of the box, paired with Fortianalyzer.
The bigger question is WTH you're doing with this. You can't put monitoring software on the devices, but you can look at every last bit they send and receive? Legal issues are a far bigger problem when data is in transit (as in flying across the network) than when it's at rest on the device. You won't even see everything, as a lot is TLS-protected and if it's a phone, it can bypass the fixed network entirely. I somehow doubt that he's making his wife and kids agree to an AUP that allows this sort of monitoring.
Absolute control is difficult and not advised (Score:5, Insightful)
An easy thing you could do is to set up a proxy on the network (such as Squid) and use DHCP to force all of the computers on the LAN to use it. It won't be foolproof unless you block any outbound web traffic that isn't coming from the proxy and that will maybe break things, but this is someone's house and not an IT shop so that's not a big deal.
After that, set up all the phones to use wifi and take the hit in battery performance, or else get everyone ipod touches instead of phones with a data plan. You can't get around the fact that he is paying for another data connection per handset from the phone company.
The *best* thing you could do is sit your friend down and advise him that the world is scary and that you can't shield your kids from everything, but you can certainly build a good rapport with them and answer questions about life when they come up.
NGFW (Score:2)
What you are describing basically sounds like what NGFW (Next Generation Firewalls) solve. These are standard firewalls, but add more "smarts" to them, like detecting certain applications, telling you which users access them and when. So you'll want something inline to do it properly.
A lot of traffic to the web may also be going over an SSL connection, so you would probably need an SSL module in-line to basically man-in-the-middle all the computers on the network and snoop the traffic.
Check out the NSS re [nsslabs.com]
Treat the disease, not the symptoms (Score:5, Insightful)
My client is trying to protect his family from scammers and other unsavory types, and isn't savvy in this matter, so i'm doing it for him.
Then you're doing it wrong.
Quite frankly, extreme monitoring and filtering isn't going to work. Scammers will hide their words to avoid filters, so active filtering doesn't work. The exchanges are managed quickly, so scams (especially phishing scams) get your data instantly, so delayed review of activity isn't going to protect anyone, either, though it might make detection a bit faster. There is simple no hardware approach that will work.
If, as others have pointed out, your client is an overly controlling patriarch, he needs professional psychiatric help. If he's just paranoid and scared, he needs professional technical help, and that's where you should focus your efforts.
Educate him and his family on scammers' techniques and tactics, and security practices. Explain how the teenage daughter will be victimized and harassed, because that's just the nature of the assholes on the Internet. From a network perspective, make sure they have updated antivirus software, and maybe an active monitoring firewall to scan HTTP traffic for viruses. A basic scanner for the known threats, and education for the unknown threats, and the client will be far better off in the long run.
"Can I write a script?" (Score:5, Funny)
I don't know. Can you?
Re: (Score:2)
Your Best Solution (Score:5, Insightful)
He wants Orwellian monitoring over his network that is not only unfeasible but would eventually prove completely ineffective. If he's this paranoid, what's going to happen when your kludge of a system inevitably misses a message or two and he decides that caused someone to fall victim to a scam? He's going to come after you with some shark lawyer and make your life incredibly annoying, that's what. In the end, his idea will not prevent scams and the like. It's only going to further a "big brother knows best and sees all" mentality. On top of that, it shows a frightening lack of trust in his family - both in their ability to "do the right thing" and in their general intelligence. Your best solution is to drop the client and not feed his totalitarian ego.
On the other hand, if this is really you wanting such a solution, the trust issues apply even moreso. Learn to EDUCATE instead of spy. You will have much better results.
And finally, if you're an ISP too clueless to do something on your own, GTFO Slashdot with your asking us how to spy on your customers. You should be ashamed of yourself.
tl;dr - Your plan is a bad idea all around...
Ah another "safety" nut... (Score:5, Insightful)
My advice? Cancel your hardwired ISP, cancel all smartphones with network access, harden your doors, windows, and other points of entry and lock you and your family in your basement. There you go, no "unsavories" or "scammers" can ever access you or your family. I'm sure that will go over well with the wife and kids, but at least you're being upfront about it and not covertly spying on them through their electronic communication (which is what you *really* want to do).
When they object, tell them the other option (your little Napoleon complex and your in-home Echelon system), and be prepared for your, sorry your "friend's" wife to serve up some divorce papers.
Oh, that's right, you just want them to be "safe". Give us a break, even the most hardened Fox News or CNN watcher isn't really *that* scared of unsavory types messing with their lives, and if you are, please turn off the television and go for a walk in the park for a few hours.
Ntop and passive TAP (Score:3)
For corporate traffic, Don't put a box in between that traffic. If it fails, everything is down. Get a TAP, as you hinted, but make sure to get one that fails 'open' [network-taps.eu]. Then, run Ntop [ntop.org] off the TAP port. If the TAP burns up, or port goes bad, you still have network access.
It sounds like your "client" is just wanting to basically monitor on his family, so in that case, get a 10/100 HUB (not a switch) to stick downstream of your modem. Plug in your linux box on port 1, and the router/modem into port 2. Don't put anything else on it because.. it's a hub. Run Ntop on the linux box.
Re: (Score:2)
Re: (Score:2)
Yes, a SPAN port would work as well but most home users don't have that option.
Look at Netflow based tools such as nfsen (Score:2)
There's a large number of tools available for collecting, analyzing and otherwise dissecting collected Netflow data, with a good number most likely available via your favorite free Unix-like operating system's packages collection. My favorite combo is to set up an OpenBSD [openbsd.org] box as the gateway, have it export traffic data via
"due to legal issues and a few other factors" (Score:4, Informative)
It obviously depends on the laws to which your client is subject but, if there are "legal issues" in putting monitoring tools on "devices on the network," you may also find that there are similar restrictions, or at least hurdles to clear, in operating an interception capability as part of the network...
If it is just a private house, for members of a family, as the summary seems to suggest, chances are these will be minimal. If it will end up monitoring the nanny, cook or whatever other staff your client might have, you might need to have more robust procedures in place. In either case, it's worth checking it out if any part of your contract says "system will comply with applicable law" or anything like that — or just for your own peace of mind.
This is... a lot of work. (Score:3, Insightful)
In reply to alot of the posters (Score:5, Informative)
Re:In reply to alot of the posters (Score:4, Insightful)
Noting that you say:
I will direct him to this post and your replies
I guess I am a little surprised that you go on to say:
I ... tried to tell him that, but computers are a big 'mystery box' to him, and I can't seem to nail stuff home on my own ... He wants the moon without having to go there to get it
Surely not a good idea to say such things about a client (under a profile of the same name as that of the submitter), whilst saying that you are going to suggest that he reads the thread?
avoid 'alarming' his family to his clandestine monitoring intentions
This rather emphasises my view that you should either get a good quality (does he have much money?) indemnity from him that what you are doing is legal, or else be *very* sure of your own legal position (and, perhaps, his)... It would seem to be more than avoiding scammers if there is a fear that those within the network would be alarmed, rather than being consulted, and being grateful for the protection they were offered?
Re: (Score:2)
I have had similar requests from a family who was concerned for their daughters welfare. The parents genuinely loved the daughter and were not over protective and had a reasonable justification for their concern. A simple solution was webwatcher monitoring software. you can look it up at webwatchernow dot com. use your best judgment in getting involved, both ethically and for legal reasons.
Another request was for an office which was being run by a former congressman. There was plenty of back and forth abou
Re: (Score:2)
Otherwise, install net-nanny and move on. And you're a fool for taking this brain-dead project this far.
Re: (Score:3)
My children know that if they make a mistake they just have to be honest about it and let me know and there's no problem. If they try to do something they know they aren't allowed to do and I see it in the logs then they lose privileges for
You and your client's biggest problem is legality (Score:2)
You might think this isn't likely to come up, but you have to bear in mind you're not just intercepting his family's communications by doing this but any guests and also the communications of anyone who is communicating with his family. I'm assuming by your reference to the NSA that you're working with someone from the United States and this makes things tricky. Many people mistakenly believe, "well I paid for it, I can do what I like with it", but this is not the case, particularly with communications se
Re: (Score:3)
So, you lied about the scammer bit, because you knew how incredibly creepy the truth sounded?
Re: (Score:3)
He does reasonable cause for suspecting something is going on and just needs to have information available to aid him in making decisions about some unusual behavior.
Then you're being coy with us about details that would really help you get good answers about this situation. And most likely, these answers will not be technological, but rather revolve around (a) seeking marriage/psychological/etc. counseling, (b) contacting law enforcement, or (c) just talking to his wife/children about what's going on.
The biggest favor you can do for this guy is to not indulge his creepy need to spy on his household. It's passive aggressiveness at its worst, when he really just needs
Translation: affair (Score:4, Insightful)
And to be more specific, it's a home network with a cable connection. (I obviously can't be too specific due to his need for anonymity to avoid 'alarming' his family to his clandestine monitoring intentions). He does reasonable cause for suspecting something is going on and just needs to have information available to aid him in making decisions about some unusual behavior.
In other words, he thinks his wife is having an affair and has seen some "unusual" transactions on the credit card or caller ID numbers, and is trying to gather "evidence" to use against her.
If you're the client, this is a hugely bad idea and could get you in very, very big legal trouble.
If you're not the client, then this is still a hugely bad idea and could get you in legal trouble.
Probably the second best move for you is to contact the wife and let her know what you've been asked to do. You might even get a larger paycheck out of it that way.
But finally, the first best move for you is to contact a qualified divorce/family law lawyer in your jurisdiction. Because before you take any further moves, you want to know which ones will get you sued and which ones will get you in jail.
Re: (Score:2)
Re: (Score:2)
What your drug-lord client is asking is impossible.
You're only going to be able to look at unencrypted traffic. MOST messaging is encrypted. iMessage is encrypted. Even in-game messaging, like in Words with Friends, etc. if it isn't encrypted now will be in the future, becuase of public criticism in the press about apps that have unencrypted messaging. So, I think you will see most smart-phone apps go to encrypted-everything for communication to their back-end servers.
The only thing that will work is to jai
Palo alto firewall products (Score:2)
Get a Palo alto firewall. You can filter by application, and even make firewall rules like "allow reading of facebook, but disallow posting", or even "disable attachments".
Of course, you didn't exactly specify budget...
Sounds like a perfect job for rpcapd. (Score:2)
Get a router compatible with tomato firmware, install tomato, and then install rpcapd on it (no need to compile from source, there are standalone binaries out there compiled for your router's CPU). Then use wireshark to monitor and capture the traffic. After that you can take your pick of software to parse the pcap files.
Hope your client is rich. (Score:2)
Because I would not touch that project for less than 5 figures plus an ongoing support contract of at least very high 4 figures or low 5 figures.
I am highly suspect of the "protect his family from scammers" and the "monitor and record all outgoing traffic"
If he is really interested about protecting his family from scammers then educating every in the home that "everything on the internet is a scam unless you personally know the person" is all that is needed.
Finally, if a lot of ipads and iphones are invol
Move to China....... (Score:2)
Libpcap and teach. (Score:2)
I once achieved this on web traffic for a large corporation back in the days where internet @ work was "new" and pr0n was the main "misuse" in working hours.
I proposed to do it as ethical as it could be done, so we agreed about obfuscating domains, the idea was to educate users that were "new" to internet, so the administrator would only get notice about a "violation of terms". (using regex for the usual++ pr0n and other stuff related terms).
There was no actual "snoop", no logging, just a hint on who to tal
pfSense (Score:3)
Google pfSense and set it as your firewall.
Linux Gateway/Router (Score:2)
I am a Linux hobbyist and can comment on the Linux router option. Totally free if you have old hardware, but limited and will not cover all of your listed requirements.
This sits between my ISP's provided modem and my wireless router which serves the living room computer, bedroom, office, and a wireless laptop and phones using wifi.
I use Debian 6 on an old Semperon with 1 gig of RAM with two NICs. Overkill I know, substitute your hardware on hand an
Impractical (Score:3)
You need to consider that these days people are starting to use HTTPS by default for things like Facebook. You won't be able to inspect the contents.
If it's scammers he is genuinely worried about, education will solve it, not monitoring (which will catch it too late, after the scam has already started).
Anyone else catch this (Score:4, Insightful)
My client is trying to protect his family from scammers and other unsavory types, and isn't savvy in this matter, so i'm doing it for him.
combined with
After days of discussion with the client
LOL. If someone can't be educated in "days" then they simply can not be protected from themselves. By "unsavory types" I assume he means us /.ers, which makes it even funnier. Would you trust me with your 19 year old daughter? Thought so. Well, she'd probably kick my butt anyway so don't worry too much.
I must be the only guy in /. with little kids that click on every spam popup window and sign themselves up for anything because... they're little kids. That is why their monitor is in a public part of the house easily viewed about 5 feet from my home office desk. My wife and I have caught them doing all kinds of ridiculous stuff and have (mostly) calmly used those events as "teachable moments", with excellent results. We've caught them watching remarkably inappropriate youtube videos, applying to work at the local Culvers (he was only 7 at the time), installing all kinds of spyware toolbars and stuff (whats more evil than a kids TV show that only exists to sell toys? I know, a kids game that only exists to install spyware! ). I'm pretty close to wiping his machine and installing debian, but people keep buying him windoze only "educational software" to my intense annoyance.
Also I must be the only guy with elderly relatives with a known proven tendency to fall for telemarketing pitches (clean your furnace ductwork for $400? Hearing aid for $5000?).
There are reasons to block/track/examine/log things beyond trying to catch the wifey cheating with the pool boy, in fact keeping a really close eye on little kids and elders is being a nice civilized responsible guy, not a jerk. In comparison "easily read evidence" and "use as proof" is simply being a jerk.
I will suggest that printing this ask /. out and giving it to the client will probably be extremely educational for the client. Probably this is one of those "the client is a little overbearing and I need some backup in arguing with him" situations. We should demand a cut of the proceeds from the consultant; maybe a tithe to the EFF would be appropriate?
Re: (Score:2)
Off topic but hey why not help you with your problems too!
Do it. Wipe their machines and install Debian. Then install Windows in a VM and periodically update a base image every time they get some new edu-software. When they, inevitably, screw up? You drop back to the base VM (little to no labor). If your kids are smart enough you can even teach them to save their data files to a local shared or network storage device so you really lose nothing when you have to ditch the VM and start with the base again
Define realistic goals (Score:2)
This seems like a big overarching project that isn't going to be possible. It reminds me of a request that I got from my client: He wanted to be able to block his employees from wasting time on Facebook. I told him that I could block sites easily enough, but it's not foolproof and a savvy enough user may be able to get around the blocks. The client then explained that he *didn't* want Facebook blocked, because his employees were involved with social networking campaigns and they needed to be on Facebook.
Re: (Score:2)
I dunno, I'm the father of an eight month old, work in computer security field professionally. When it comes to computer security, My rule-of-thumb is: It's not whether your paranoid or not, it whether you're paranoid enough. That being said, When my son is of an appropriate age to start being exposed to the inter-tubes, I'm either going to setup http://www.pfsense.org/ [pfsense.org] and/or http://dansguardian.org/ [dansguardian.org] . When he gets to the age where he can start circumventing that stuff, I'm going to pat him on t
A few things which will help (Score:4, Informative)
A few things:
Better firewalls, including even the lowly dd-wrt and the now-defunct Snapgear, support syslog so you can capture and create your own custom reports, and dd-wrt reports total bandwidth usage on a daily, monthly and and annual basis and will retain that info until you do a reset (or until it runs out of NVRAM). It can come in very handy if your ISP claims you hit your bandwidth cap.
Another thing you might want to try is IMFIREWALL/WFilter in monitoring mode to see which users are doing what on your network. What is required is to either put a port on your switch (connected to your gateway/firewall) in either promiscuous mode or a two-way mirror to the port that connects to the firewall.
http://www.imfirewall.us/WFilter.htm [imfirewall.us]
It will report the number of hits to instant messaging, streaming, social networking, porn, gambling, stock trading, and any other criteria you can think of configuring. You can also put it in filter mode so it will basically kill any requests that you disapprove of, but in monitoring mode you can create custom reports of who is doing what.
Other firewalls will include these features as integrated, but some vendors (Cisco, Sonicwall) won't sell you the complete feature set for a flat price; they nickle and dime you because it's more profitable, and when the unit dies, good luck transferring those purchases.
You might want to check out m0n0wall as well, and get a good syslog app so you can capture detailed logs and create your own detailed status reports.
A Netflow / Proxy Approach (Score:2)
As a network engineer for a major financial trading company I've some experience in this area. I've also served as a network engineer for several companies in various fields (Internet Service Provider, Professional Services Vendor, Extremely Large Retail (Borders... I'll miss you.). In my experience traffic monitoring becomes a key requirement of any efficient & secure organization and a key responsibility of any qualified network engineer.
Depending on context traffic monitoring has sever
Don't (Score:3)
"and some game called 'words' which has message capability"
So the guy wants to wire tap everything they use, period. Even a freaking games? Most of those games already filter "bad words".
One thing you can do is set all their DNS servers to use OpenDNS's FamilyShield. It will do a pretty good job of filtering bad sites/etc at the DNS level.
As for logging, I wouldn't. That just sounds like not only violating your family's privacy (okay so they're under-age? That may be okay) but should anyone else happen to use the device and have no clue the things they were typing or doing were being recorded could pose a big issue.
It's a thought anyhow.
Low tech start (Score:2)
As has been pointed out, deep packet inspection of everything isn't realistic.
You might start by logging websites visited, either with local monitoring or using open dns.
Apologies (Score:4, Informative)
Re: (Score:3)
Really, the only reason this was ever voted up from the firehose is because it was a darn good troll.
I love all the show-off posts trotting-out incredibly detailed and complex solutions that won't work.
There's no need to apologize. You provided a few mintues of great entertainment. It's what Slashdot is all about!
Sadly, it's not just entertaining - it's depressing - to see so many "experts" sucked-in by this. I think many of them actually think their solutions would be useful.
Cameras, seriously (Score:2)
Record? (Score:3)
wrong approach (Score:2)
Re: (Score:2)
Or the guy knows his wife is cheating on him and is just trying to get proof he can use during a divorce. Not everyone is a violent asshole.
Re: (Score:3, Insightful)
If he wants proof he can use during a divorce, he should probably ask the judge to authorize a subpoena of facebook messages posted by the soon-to-be-ex, rather than engaging in clandestine surveillance which very well may be illegal, and cost him a lot more than he's going to win in any divorce settlement.
Re:sniffin the network for Facebook "screenshots". (Score:5, Funny)
you just went full retard.
At least he can 'make his own cables and such'.
Re: (Score:3)
That is the technical side. Now, ethically, this is a bad idea. I capture packets for clients all the time, but my analysis is only concerned
Re: (Score:2)
Re: (Score:2)
#3 is only an issue if I get caught, now isn't it. :-)
You are correct in that most here are concerned with technical possibility, but that is because it is what interests us. You are incorrect that as a collective we don't think about morality or legality. And just now is when I realize that you are a clever troll and I don't have my AC thresholds set correctly... Bah.
Re:sounds fishy (Score:4, Interesting)
Finding a cheating spouse is way easier than that.
One of my acquaintances recently went through this. Evidence was *everywhere* on the computer, facebook, e-mail, etc.
When you save your password you are trusting everyone with access to that machine not to cheat and look at your profiles. Maybe you should change those passwords and not save the updated ones before you have a tryst.
Best thing ever: Judge ruled it was not unauthorized access for him to dump her e-mails to the printer because she had saved the password to the same computer that he had authorized access to, and since she saved the passwords so that IE would auto-enter them she had no expectation of privacy...
-nB
Re: (Score:2)
If he is truly only altruistically concerned about something like phishing scams getting the better of his family, then a technical solution is NOT going to work in any way. First and foremost, because all of the activity will be on a web based email or banking site which is 100% encrypted and will blend in with the 1000 emails from aunt sally about her cats.
If he is not (merely) altruistically concerned and does intend on this as a solution for things like stopping his teens from "e-dating" or whatever he