From owner-freebsd-questions Mon Dec 15 12:57:24 1997 Return-Path: Received: (from root@localhost) by hub.freebsd.org (8.8.7/8.8.7) id MAA13130 for questions-outgoing; Mon, 15 Dec 1997 12:57:24 -0800 (PST) (envelope-from owner-freebsd-questions) Received: from awfulhak.demon.co.uk (awfulhak.demon.co.uk [158.152.17.1]) by hub.freebsd.org (8.8.7/8.8.7) with ESMTP id MAA13084 for ; Mon, 15 Dec 1997 12:57:08 -0800 (PST) (envelope-from brian@awfulhak.org) Received: from gate.lan.awfulhak.org (localhost [127.0.0.1]) by awfulhak.demon.co.uk (8.8.7/8.8.7) with ESMTP id UAA09612; Mon, 15 Dec 1997 20:46:15 GMT (envelope-from brian@gate.lan.awfulhak.org) Message-Id: <199712152046.UAA09612@awfulhak.demon.co.uk> X-Mailer: exmh version 2.0zeta 7/24/97 To: "Joe \"Marcus\" Clarke" cc: FreeBSD User Questions List Subject: Re: Alias logging In-reply-to: Your message of "Mon, 15 Dec 1997 06:37:16 EST." Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Date: Mon, 15 Dec 1997 20:46:15 +0000 From: Brian Somers Sender: owner-freebsd-questions@freebsd.org X-Loop: FreeBSD.org Precedence: bulk > Okay, this may seem like a simple question, but it's late here, and my > brain is not operating at 100%. I figure someone out there in the world > may be seeing this in mid-afternoon...I want to track which machines > from my internal network use the Internet. I don't have a firewall as I > am using user ppp's packet filtering feature, and my internal network is > a fake subnet anyway. So here's an example: > > I am a user that gets on Netscape from my Mac, and goes and looks at a > page. User mode ppp receives the request, masquerades the incoming IP, > and forwards the packets. Is there a way I can log where that user went > and at what time? Thanks. I'd tend to build in a real firewall and use the `ipfw ... log ...' feature, or even use tcpdump - both on your internal interface. You can get more control that way. Ppp itself can log this stuff, but it's an ``all or nothing'' scenario so you'd need *lots* of disk space and it'd probably take some time to parse to get your stats out. > Joe Clarke > -- Brian , , Don't _EVER_ lose your sense of humour....