Does anyone know about software that can detect or monitor host / url are being accessed by ubuntu? I want to see what host/url are beeing accessed by installed software or by my internet browser.
2 Answers
For just watching general traffic destinations, I like using iftop:
sudo iftop
It'll show a live report with speeds, through-put, etc:
25.0Kb 50.0Kb 75.0Kb 100Kb 125Kb
└───────────────┴───────────────┴───────────────┴───────────────┴───────────────
system.outflux.net => wildcard-edge-launchpad-n 3.49Kb 3.94Kb 3.94Kb
<= 3.38Kb 10.3Kb 10.3Kb
────────────────────────────────────────────────────────────────────────────────
TX: cumm: 71.3KB peak: 154Kb rates: 154Kb 95.0Kb 95.0Kb
RX: 47.6KB 126Kb 126Kb 63.4Kb 63.4Kb
TOTAL: 119KB 280Kb 280Kb 158Kb 158Kb
Note that iftop
will choose the first network interface it finds to monitor (usually eth0
for your ethernet cable). If you'd like it to listen to another interface, like your wireless card, you can list valid interfaces with ifconfig
, and then call iftop -i [interface_name]
.
For watching your browser, I recommend the Tamper Data extension for Firefox. Opening its window will show you all the active and historical requests:
-
1HttpFox provides similar monitor functionality as Tamper Data, without methods for "tampering" (modifying) the data. Feb 16, 2011 at 7:52
Hmmm, you can set up a http proxy software (like squid) and using that: proxy server will log accesses. Another solution: use netfilter of the linux kernel (with iptables
) to log network connections. If you use the ULOG
target, with ulogd
daemon you can use different log file, LOG
will use the kernel log, which is not so nice in my opinion since other messages go there too which are produced by the kernel.
-
is there any real time application (GUI or Console), so I don't need to open the log file? Feb 13, 2011 at 9:58
-
I am not sure what you mean about "real time" application. If you have a log file, you can see its content "real time" in terminal like
tail -f /var/log/ulog/syslogemu.log
(that's ulogd default log file), then you will see "real time". But you have some "not so perfect" solutions, like you can usenetstat -na
to see the actual network connections, ofiftop
(from packageiftop
) to see a top like interface with the current connections. I think even the nicest GUI applications for this (if exits) uses log file or other information sources anyway, ulogd is via netlink sockets for example– LGBFeb 13, 2011 at 10:19 -
Also for nice GUI solution you can use softwares like conky conky.sourceforge.net which is a system monitor, you can configure it to show log files as well among many other things.– LGBFeb 13, 2011 at 10:24
-
I forgot to mention: of course netfilter logging etc won't log the URL itself just the IP of the target web server for example. For real HTTP level logging usage of some http proxy is needed, it's not a problem if your apps can't do proxy: you can use transparent proxy as well: apps can't even know they use proxy. And iftop is a general "real time" traffic monitoring tool, it's not strictly http related of course, it was only an example. Anyway I hope I could give you some pointers ....– LGBFeb 13, 2011 at 13:38