1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

How do I keep a tally of requested domain names by each local host?

Discussion in 'Tomato Firmware' started by najevi, Dec 15, 2007.

  1. najevi

    najevi LI Guru Member

    I'm exhausted right now and can't think very clearly so forgive me if the script for this task is obvious to some:

    Goal
    I'd like to keep a running tally/count/sum of how often each domain server <resolved target IP> is being requested by each host on my LAN <source host IP> since logging was enabled. It is not important to know port, protocol, time of day, amount of data etc. - just a crude running total that I can examine from time to time to see if any new candidates for adding to a block list have appeared.

    Feature Creep
    For requests to domain servers that resolve to specific IP addresses whether specified by IP address (e.g. 127.0.0.1 & 0.0.0.0) or by domain name (e.g block.opendns.com & custom.block.local) it would be very handy if I could OPTIONALLY keep a tally indexed by the original domain name being requested <raw target domain>. (e.g. undesirable.site.com & must.access.org)

    i.e. A list I could examine from time to time to see if there are new candidates for adding to a whitelist.

    Possible Implementation
    I haven't given this any more thought than imagining using an associative array with index fields as mentioned already e.g.
    TALLY1[<source host IP>, <resolved target IP>] - for the first type of log
    and
    TALLY2[<source host IP>, <raw target domain>] - for the second type of log.

    Of course I'd want these arrays to be saved to CIFS1 or CIFS2 from time to time much like the tomato_rstats_###.gz is backed up periodically.

    And for it to be easy to parse I'd prefer to have a host name look up array on hand to save me the further trouble of iteratively 'ping -a <IP address>' for each unique <source host IP> and <resolved target IP>

    NAME[<IP address>]

    Where I need help is being pointed in the right direction to know what basic logging tool will give me the raw data that I need for this task. And whether it is likely to be too great a load on the router or not.

    In case you are wondering EVERY local host is assigned a static IP address.

    ... and yes, I do have teenagers on the network!
     
  2. mraneri

    mraneri LI Guru Member

    OpenDNS will keep track and provide nice reports, but it will group all PC's on your LAN together, so you won't know who's been looking up each IP.

    Otherwise, it works well, though. I definitely recommend OpenDNS.
     
  3. paped

    paped LI Guru Member

    I have never seen this done on a linksys wrt and I do not know the actual name of the application used but I have seen this done with a Syslog application that could resolve IP addresses to URL's and add them to the syslog output display replacing the IP address of the site.

    I have not tried this but you can syslog to an external IP address/PC within tomato and you appear to be able to set the logging to show accepted or denied connections so in theory (probably with a bit of work/playing around) I would have thought that this would give you something like what you are looking for. Google should be able to help re the actual syslog application that can do this....
     
  4. paped

    paped LI Guru Member

    A quick google these are not the syslog application I was thinking of but again appear to be something similar to what you are looking for and they say that they work with Linksys.... but not sure if they work with tomato though.

    http://www.linklogger.com/
    http://www.sonic.net/wallwatcher/

    Hope this helps....
     
  5. mraneri

    mraneri LI Guru Member

    you can probably take paped's suggestions, and combine it with a dnsmasq option which logs all DNS queries. not sure what detail is provided in the log, but it may have to requesting IP. If it does, it may be an easier log to process than all accepted/dropped connection attempts...
     
  6. najevi

    najevi LI Guru Member

    opendns delivers 99%

    Thanks for your suggestions. I did revisit opendns and the Stats that they provide. Those stats are so close to everything that I need (minus the local host names of course) that I think I will make do with what opendns provides.
     

Share This Page