7 ms·

I'd like to collect something at the router level to learn how my kids are using the Internet. Like I'd like to know the sites being visited on different devic

by pknerd 2y ago

I'd like to collect something at the router level to learn how my kids are using the Internet. Like I'd like to know the sites being visited on different devices. Is there any such thing possible?

majormjr 2y ago
If you have a switch with port mirroring you can send the traffic to another device and monitor using something like Suricata.
whilenot-dev 2y ago
Can you install netopng[0] on the router? [0]: https://www.ntop.org/products/traffic-analysis/ntop/ https://www.ntop.org/products/traffic-analysis/ntop/
INTPenis 2y ago
OpenWRT has prometheus node exporter packages. But in your case I think a PiHole would make sense, first of all you don't need to put it on the router, just point the router's default DNS to your pihole. But a pihole will give you a nice dashboard of all the DNS records resolved in your network. Which will give you a really good idea of what your kids are doing, since most of it is via DNS.
uncharted9 2y ago
I've used NextDNS. Pretty handy. Just change DNS settings on devices with your NextDNS profile specific resolver address and you can see the logs of all websites accessed from each device.
pbhjpbhj 2y ago
Pihole will show you devices and the domains they access, it's not particularly designed towards that end, but it can. You can sit down with them and have a look at their history? I use Pihole to block nefarious sites (malware etc.) but also I use the OpenDNS (now Cisco) family friendly DNS addresses as nameservers. I can add domains if needed through the Pihole interface, or through the OpenDNS interface (former is easier). It's not watertight, but I figure if they can work out how to workaround it then they're at a level where I should give more generic guidance. They get exposed to porn and what not on social media (which I don't block) and through friends at school and through their friends devices, or connecting to other networks I don't have control over. Easiest workaround imo is to fire up a browser that uses TOR. Mind you we're a computer/consoles only in family rooms household and they don't get phones until they go to highschool (11yo).
- CommanderData 2y ago
  With DNS over HTTPS and others, this is becoming less possible. I think Chrome does this by default on some platforms.
- ElCapitanMarkla 2y ago
  It’s also handy for making a special rule which can be toggled to totally block YouTube on the kids iPad.
tau255 2y ago
You can do that with pihole, if you set it up to keep the logs. Just adjust dhcp settings so your devices get its address as DNS server.
garyfirestorm 2y ago
Adguard is much better in my experience compared to pihole.
hackerknew 2y ago
Years ago, I set up https://mitmproxy.org https://mitmproxy.org on a Raspberry Pi and used it to get logs of every site that my kids would visit. I should be clear that monitoring/spying != parenting, but it definitely made me feel a little better to have some idea of what the kids are using the internet for. From a technical perspective, it did exactly what you want. I had logs of full urls (not just domains). So, for example, I could view what they googled and when, if I wanted to anyway. It did involve installing a certificate on the computer that they use, but there are how-to guides so setting everything up was simply a matter of following instructions. The biggest drawback is that it noticeably slowed their internet. I imagine if I had run this on a more powerful computer it may have been better. --- Note, for those suggesting PiHole, it is very good for getting logs of domains accessed, but not very informative. For example, you can tell that a computer accessed "youtube.com" at a certain time, but not what was actually viewed. That may be obvious to many of us, but just clarifying in case it is not obvious to the OP.
- brianstrimp 2y ago
  > So, for example, I could view what they googled and when, if I wanted to anyway. How old are your kids and do they know you are doing this? There surely is a difference between a 5- and a 15-year old. But if they are not at all aware they are constantly being watched like that, man that's some serious breach of trust. This full-on surveillance could damage your kids for life. I'm so glad this kind of tech hardly existed when I was a kid 30 years ago.
  - therein 2y ago
    This tech existed 30 years ago, just wasn't packaged up for easy deployment. As late as 2012 you could MITM people in your network, even without being the person managing the router. ARP poisoning and mitmproxy or just some intelligent reverse proxy, you could pick up the cookies, URLs, and POST data for all the requests in the network.
    - brianstrimp 2y ago
      Sure, a computer nerd dad could have somehow surveilled me dialling into some BBS with my 28.8 kbps modem, but the number of people in the world that actually did this to their kids can probably be counted on one hand, and they were all psychos. MITM-ing https google searches with a custom root cert today, man, you don't want to leave your kids any privacy? Do you also have hidden cameras in their bedroom? That's roughly on the same level.
petee 2y ago
I use Unbound as my local dns resolver, and it has an option to live dump unique names to a file (but not the ips that requested it.) Its easy to parse and you get a general idea whats passing through; the individual clients don't matter to me unless something looks like its worth investigating, then use dnstop for specifics. Edit: I forgot not all traffic will use the local resolver, so dnstop would be more accurate
ranger_danger 2y ago
I just turn on netflow on my router and have it send the flows to another machine on the LAN that's running ntopng.
firecall 2y ago
Deleted
lormayna 2y ago
If you have a decent router, you can configure Netflow and send flows to a collector and then you can ingest in an ELK or similar platforms for further analysis. It requires a bit of work, but combined with DNS logs it's the best way to monitor the traffic
throawayonthe 2y ago
[dead]
twst23r 2y ago
maybe try to talk to them instead of trying to spy on them
- pknerd 2y ago
  Agreed and that's what I do. The purpose is not the content but the time they spend online

by pknerd 2y ago

I'd like to collect something at the router level to learn how my kids are using the Internet. Like I'd like to know the sites being visited on different devices. Is there any such thing possible?

majormjr 2y ago

If you have a switch with port mirroring you can send the traffic to another device and monitor using something like Suricata.

whilenot-dev 2y ago

Can you install netopng[0] on the router? [0]: https://www.ntop.org/products/traffic-analysis/ntop/ https://www.ntop.org/products/traffic-analysis/ntop/

INTPenis 2y ago

OpenWRT has prometheus node exporter packages. But in your case I think a PiHole would make sense, first of all you don't need to put it on the router, just point the router's default DNS to your pihole. But a pihole will give you a nice dashboard of all the DNS records resolved in your network. Which will give you a really good idea of what your kids are doing, since most of it is via DNS.

uncharted9 2y ago

I've used NextDNS. Pretty handy. Just change DNS settings on devices with your NextDNS profile specific resolver address and you can see the logs of all websites accessed from each device.

pbhjpbhj 2y ago

Pihole will show you devices and the domains they access, it's not particularly designed towards that end, but it can. You can sit down with them and have a look at their history? I use Pihole to block nefarious sites (malware etc.) but also I use the OpenDNS (now Cisco) family friendly DNS addresses as nameservers. I can add domains if needed through the Pihole interface, or through the OpenDNS interface (former is easier). It's not watertight, but I figure if they can work out how to workaround it then they're at a level where I should give more generic guidance. They get exposed to porn and what not on social media (which I don't block) and through friends at school and through their friends devices, or connecting to other networks I don't have control over. Easiest workaround imo is to fire up a browser that uses TOR. Mind you we're a computer/consoles only in family rooms household and they don't get phones until they go to highschool (11yo).

CommanderData 2y ago
With DNS over HTTPS and others, this is becoming less possible. I think Chrome does this by default on some platforms.
ElCapitanMarkla 2y ago
It’s also handy for making a special rule which can be toggled to totally block YouTube on the kids iPad.

tau255 2y ago

You can do that with pihole, if you set it up to keep the logs. Just adjust dhcp settings so your devices get its address as DNS server.

garyfirestorm 2y ago

Adguard is much better in my experience compared to pihole.

hackerknew 2y ago

Years ago, I set up https://mitmproxy.org https://mitmproxy.org on a Raspberry Pi and used it to get logs of every site that my kids would visit. I should be clear that monitoring/spying != parenting, but it definitely made me feel a little better to have some idea of what the kids are using the internet for. From a technical perspective, it did exactly what you want. I had logs of full urls (not just domains). So, for example, I could view what they googled and when, if I wanted to anyway. It did involve installing a certificate on the computer that they use, but there are how-to guides so setting everything up was simply a matter of following instructions. The biggest drawback is that it noticeably slowed their internet. I imagine if I had run this on a more powerful computer it may have been better. --- Note, for those suggesting PiHole, it is very good for getting logs of domains accessed, but not very informative. For example, you can tell that a computer accessed "youtube.com" at a certain time, but not what was actually viewed. That may be obvious to many of us, but just clarifying in case it is not obvious to the OP.

brianstrimp 2y ago
> So, for example, I could view what they googled and when, if I wanted to anyway. How old are your kids and do they know you are doing this? There surely is a difference between a 5- and a 15-year old. But if they are not at all aware they are constantly being watched like that, man that's some serious breach of trust. This full-on surveillance could damage your kids for life. I'm so glad this kind of tech hardly existed when I was a kid 30 years ago.
- therein 2y ago
  This tech existed 30 years ago, just wasn't packaged up for easy deployment. As late as 2012 you could MITM people in your network, even without being the person managing the router. ARP poisoning and mitmproxy or just some intelligent reverse proxy, you could pick up the cookies, URLs, and POST data for all the requests in the network.
  - brianstrimp 2y ago
    Sure, a computer nerd dad could have somehow surveilled me dialling into some BBS with my 28.8 kbps modem, but the number of people in the world that actually did this to their kids can probably be counted on one hand, and they were all psychos. MITM-ing https google searches with a custom root cert today, man, you don't want to leave your kids any privacy? Do you also have hidden cameras in their bedroom? That's roughly on the same level.

petee 2y ago

I use Unbound as my local dns resolver, and it has an option to live dump unique names to a file (but not the ips that requested it.) Its easy to parse and you get a general idea whats passing through; the individual clients don't matter to me unless something looks like its worth investigating, then use dnstop for specifics. Edit: I forgot not all traffic will use the local resolver, so dnstop would be more accurate

ranger_danger 2y ago

I just turn on netflow on my router and have it send the flows to another machine on the LAN that's running ntopng.

firecall 2y ago

Deleted

lormayna 2y ago

If you have a decent router, you can configure Netflow and send flows to a collector and then you can ingest in an ELK or similar platforms for further analysis. It requires a bit of work, but combined with DNS logs it's the best way to monitor the traffic

throawayonthe 2y ago

[dead]

twst23r 2y ago

maybe try to talk to them instead of trying to spy on them

pknerd 2y ago
Agreed and that's what I do. The purpose is not the content but the time they spend online