9

Does anyone know about software that can detect or monitor host / url are being accessed by ubuntu? I want to see what host/url are beeing accessed by installed software or by my internet browser.

2 Answers 2

5

For just watching general traffic destinations, I like using iftop:

sudo iftop

It'll show a live report with speeds, through-put, etc:

                25.0Kb          50.0Kb          75.0Kb          100Kb      125Kb
└───────────────┴───────────────┴───────────────┴───────────────┴───────────────
system.outflux.net         => wildcard-edge-launchpad-n  3.49Kb  3.94Kb  3.94Kb
                           <=                            3.38Kb  10.3Kb  10.3Kb
────────────────────────────────────────────────────────────────────────────────
TX:             cumm:  71.3KB   peak:    154Kb  rates:    154Kb  95.0Kb  95.0Kb
RX:                    47.6KB            126Kb            126Kb  63.4Kb  63.4Kb
TOTAL:                  119KB            280Kb            280Kb   158Kb   158Kb

Note that iftop will choose the first network interface it finds to monitor (usually eth0 for your ethernet cable). If you'd like it to listen to another interface, like your wireless card, you can list valid interfaces with ifconfig, and then call iftop -i [interface_name].

For watching your browser, I recommend the Tamper Data extension for Firefox. Opening its window will show you all the active and historical requests:

enter image description here

1
  • 1
    HttpFox provides similar monitor functionality as Tamper Data, without methods for "tampering" (modifying) the data.
    – Lekensteyn
    Feb 16, 2011 at 7:52
1

Hmmm, you can set up a http proxy software (like squid) and using that: proxy server will log accesses. Another solution: use netfilter of the linux kernel (with iptables) to log network connections. If you use the ULOG target, with ulogd daemon you can use different log file, LOG will use the kernel log, which is not so nice in my opinion since other messages go there too which are produced by the kernel.

4
  • is there any real time application (GUI or Console), so I don't need to open the log file? Feb 13, 2011 at 9:58
  • I am not sure what you mean about "real time" application. If you have a log file, you can see its content "real time" in terminal like tail -f /var/log/ulog/syslogemu.log (that's ulogd default log file), then you will see "real time". But you have some "not so perfect" solutions, like you can use netstat -na to see the actual network connections, of iftop (from package iftop) to see a top like interface with the current connections. I think even the nicest GUI applications for this (if exits) uses log file or other information sources anyway, ulogd is via netlink sockets for example
    – LGB
    Feb 13, 2011 at 10:19
  • Also for nice GUI solution you can use softwares like conky conky.sourceforge.net which is a system monitor, you can configure it to show log files as well among many other things.
    – LGB
    Feb 13, 2011 at 10:24
  • I forgot to mention: of course netfilter logging etc won't log the URL itself just the IP of the target web server for example. For real HTTP level logging usage of some http proxy is needed, it's not a problem if your apps can't do proxy: you can use transparent proxy as well: apps can't even know they use proxy. And iftop is a general "real time" traffic monitoring tool, it's not strictly http related of course, it was only an example. Anyway I hope I could give you some pointers ....
    – LGB
    Feb 13, 2011 at 13:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .