aleksandr-oliferuk / pcap2squid

Recieve raw network trafic dump in pcap-format and parse it to squid-proxy log. Then generate report for lightsquid and shows it in Web UI

pcap-dump parser to squid-proxy log format

Description

Recieve raw network trafic dump in pcap-format and parse it to squid-proxy log. Then generate report for lightsquid and shows it in Web UI.

This implementation get traffic from mikrotik sniffer on udp port 37008 and parse it with trafr program. You could rebuild parser image without it and recieve trafic just with tcpdump.

With this tool you will get statistics, which sites and when watch users of your LAN. But it doesn't give you actual trafic amount.

Usage

Clone this project, complete .env with your values, then run it with docker-compose up -d

After that you should setup your cron on host machine with something like this:

*/5 * * * * docker exec pcap2squid_lightsquid_1 ./lightparser.pl today 2>> $PROJ_PATH/errors.log
59 23 * * * echo '' > $PROJ_PATH/log/access.log

Report will appear at http://$LIGHTSQUID_ADDR:$LIGHTSQUID_LISTEN_PORT

Environment example

# Path, where you download this project
PROJ_PATH="/srv/pcap2squid"

# Lightsquid vars
LIGHTSQUID_ADDR="192.168.1.1"
LIGHTSQUID_LISTEN_PORT=80

Some advices

The best way to use ramdisk for all processed files. E.g. of fstab:

tmpfs   $PROJ_PATH/dump   tmpfs   rw,size=500M    0       0
tmpfs   $PROJ_PATH/log   tmpfs   rw,size=5G        0       0

To change language of lightsquid report just change $lang parameter in lightsquid.cfg and rebuild lightsquid image.

If you are using phpIPAM, you could use my script to complete lightsquid report with real names of ip-addrs owners (realname.cfg).

Screenshots