[Ntop] Ntop & http_proxy
Craig.Humphrey at chapmantripp.com
Thu Mar 22 02:23:00 CET 2007
first up, dare I ask why you are using a proxy that is out on the
internet, rather than local on your network?
If what you're after is "What websites are my users accessing", I would
suggest putting a proxy on your local network. This local proxy can be
chained up to the remote proxy (if you still need it) and once all your
local machines are using the local proxy, it will contain a log of all
the sites they access. Proxy's like Squid are free, so other than
hardware, there's no real excuse not to have one.
Ntop isn't really for inspecting network packets to see what people are
doing. It's more general and looks more at what kinds of traffic is
being generated. There are more advanced packet inspection tools out
there which may have the ability to interprit proxy traffic and report
On the other hand, you could, like I said, write a proxy traffic packet
inspector for ntop (I'm sure Luca et al would love it) which would
extend ntop to report at this level.
Hope that helps.
From: ntop-bounces at unipi.it [mailto:ntop-bounces at unipi.it] On
Behalf Of AnOnJoe
Sent: Tuesday, March 20, 2007 8:49 PM
To: ntop at unipi.it
Subject: Re: [Ntop] Ntop & http_proxy
WALI / Craig :
Here is how my network works :
| Switched Local Network |
_________|________ _______ ________ I
| HUB |__| PIX |__| Router |__I INTERNET
I__// __| PROXY |
|__________________| |_______| |________| I
I // |_______|
| NTOP |
In green the Network I manage
In red the Network I can't manage...
1) I have no access to the proxy logs...
2) does i need to do something like that :
| Network 192.168.0.1/24 |
| NTOP |__//__ | Outside |
|_______| // |_________|
3) How to do that ?
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Ntop