Which home-based router for internet usage logging

[homer_at]

I am looking for a router that will enable me to log internet websites visited for each device on the network, using the router. I want to check that my young child is not visiting bad websites using his Android tablet or when he is on the PC. I would like a log of internal IP address, IP address visited, even better, internet address ( www.cnn.com), date and time.

I want to do this with the router, I don't want to install software on individual PCs, and don't think I can install anything on the tablet. Seems to me that all I want to know should be available via the router.

I have seen the article about using wallwatcher but suspect that is over my head. my router model is on the wallwatcher supported router list.

I am already using open dns to filter porn.

My Dlink will log firewall stats, blocked IPs, etc, but not regular usage.

the Linksys EA6500 looks like it will do it with the log using their Smart WiFi, but I have read bad things about the overall product.

I have downloaded ASUS and Netgear manuals but the manuals are too brief to tell if they log what I want.

I am not looking to start a discussion or get lectured about the morals of logging my child's activity.

thanks
homer_at

 

[thiggins]

It is generally difficult to find routers that log web traffic. Linksys has traditionally offered this and continues to do so. But the level of detail is pretty basic.

 

[stig]

If the router supports web proxy then you can log web traffic with quite a bit of detail. One downside to using a web proxy is that traffic is no longer "forwarded" through the router. Instead the each tcp session is terminated on the router and the router initiates (or proxys) a new tcp session. The significance of that is that many routers have a "fast path" for forwarded traffic that is significantly faster than traffic that has to go to user space on the router. That isn't too much of an issue if you're talking about 20-25Mbits of traffic, but will require a lot more cpu horsepower if you need 1Gbit.

 

[homer_at]

Tim - I have a Synology 213+ which has a Syslog Server Package. My router is the Dlink 655 which says it will publish logs to a Syslog server. Do you know if that will provide the logging that I seek?

thanks for your help and your helpful website.
homer_at

 

[stevech]

syslog can log short 200 character type event messages only if some software on network hosts creates such. I don't know of one that does so.

 

[thiggins]

Tim - I have a Synology 213+ which has a Syslog Server Package. My router is the Dlink 655 which says it will publish logs to a Syslog server. Do you know if that will provide the logging that I seek?

thanks for your help and your helpful website.
homer_at

I don't know. Sometimes routers will log information to the syslog stream that they don't display on the web admin page. But you won't know until you try it.

Syslog servers mainly just capture information sent to them. You probably want some analysis or summarization of the data or you'll go nuts just looking at URL streams. I don't think the Synology Syslog package does this.

If you are willing to use a PC to capture the logs, you might try Splunk.

 

[stevech]

KiWi syslog is great. I use it.

Cradlepoint's routers have both syslog output, and optionally, its own syslog capture of the last few hundred events. But it logs only things like connectivity losses, attempts from the WAN side to access via a closed port number, apparent DoS attacks by IP, and so on. I've used the log to see the commonplace robot-attacks trying to use telnet or SSH or port 80. Usually, the host is in the domain attributed to China or eastern Europe. I put such host IP ranges in the black-list of the Cradlepoint - where it refuses all traffic from an IP address range.

 

[PrivateJoker]

KiWi syslog is great. I use it.

Cradlepoint's routers have both syslog output, and optionally, its own syslog capture of the last few hundred events. But it logs only things like connectivity losses, attempts from the WAN side to access via a closed port number, apparent DoS attacks by IP, and so on. I've used the log to see the commonplace robot-attacks trying to use telnet or SSH or port 80. Usually, the host is in the domain attributed to China or eastern Europe. I put such host IP ranges in the black-list of the Cradlepoint - where it refuses all traffic from an IP address range.

@Stevech & Tim, et al,- in a consumer/prosumer level do most people who are looking for a logging function utilize syslog, or SNMP (with the router and possibly individual NICs reporting to it)?

I have never used (or needed) either form of logging, just curious in a broad overview kind of way if one, or neither of them would be more or less feasible in niche prosumer/SOHO instances.

thx!