How to monitor my LAN network traffic

[Koshur]

Hi

I want to know if there is a way i can monitor my LAN network. I want to keep an eye on my 12 year old cousin, and dont want him to browse some random weird suff on internet. He is too much into warez and vulnerable online gaming sites. This puts the him at risk at too young age. Obviously i dont want to crackdown on him at random but quietly monitor so that i can guide him through.

Is there a way i can monitor and if required block certain sites/ URL's ( no windows used its a live user for an ubuntu distro), i am looking for something at the network level (on router level).

I have a beetle 450TC1 wifi router with one wired desktop and two laptops:

One is my own (dual boot win7 and ubuntu distro) - running on wifi

My cousin's (for safety i gave him a live user bootable linux distro - bootable from USB stick) - no installed OS - running on wifi same network

Is there a program i can deploy on admin level of router or on LAN to monitor my traffic. May be if possible this would also serve as a bandwidth monitor and give me an estimate of my monthly usage.

Thanks

Mark

[Gerowen]

Hi

I want to know if there is a way i can monitor my LAN network. I want to keep an eye on my 12 year old cousin, and dont want him to browse some random weird suff on internet. He is too much into warez and vulnerable online gaming sites. This puts the him at risk at too young age. Obviously i dont want to crackdown on him at random but quietly monitor so that i can guide him through.

Is there a way i can monitor and if required block certain sites/ URL's ( no windows used its a live user for an ubuntu distro), i am looking for something at the network level (on router level).

I have a beetle 450TC1 wifi router with one wired desktop and two laptops:

One is my own (dual boot win7 and ubuntu distro) - running on wifi

My cousin's (for safety i gave him a live user bootable linux distro - bootable from USB stick) - no installed OS - running on wifi same network

Is there a program i can deploy on admin level of router or on LAN to monitor my traffic. May be if possible this would also serve as a bandwidth monitor and give me an estimate of my monthly usage.

Thanks

Mark

You could invest in some 3rd party firmware like DD-WRT or Tomato. Not sure which ones would work on your router, but I've been running DD-WRT on my router for a while and it gives me a lot of info. I have to use the "lite" version because of my older router, but it gives you a chart to track how much bandwidth has been used in the last day, week and month, and you can look back at past months as well. You can filter sites by keyword as well as URL. In fact a lot of routers are coming with some of these features built into the factory firmware. You can even use QoS to prioritize bandwidth to particular machines, or restrict certain types of traffic so he can't eat up all your bandwidth with bittorrent downloads. You could even use a 3rd party DNS server to filter traffic and websites as appropriate. I use DynDNS for a public hostname but they also offer security services, and all you have to do is configure your router to forward all traffic through their DNS servers first. OpenDNS is another one I've heard of.

Anyway I'll stop rambling, I was just throwing ideas out there.

[Koshur]

Hi

Ok. here is what ive got so far.

1. Signed up for opendns (coz dydns is not free)
   
2. Added my network
   
3. Enabled updation of my dynamic ip.
   
4. installed their ip updation client for win.
   
5. choose the settings on moderate level filtering
   
6. Updated my router to use their DNS servers
   

Once i apply these settings on my opendns dashboard, it says it would take 3 min to push all settings across the servers, But guess what i am still able to open porn sites on my client. !! :(

Also my router has an option for dydns account but not for opendns...

I am not sure what i am missing on this one. Please see the screenshots

[Koshur]

hang on guys..its working on the clients but i need to keep the ip updater on... is there a way i can put this on my router so that i dont have to setup this at every client level?? I am using ubuntu distros as OS as well. and the ddclient on that is a mess to setup..which is y i am looking for a router level restricting. Any ideas?

[+BudMan MVC]

there are a couple of ways to do it, you can have your router hand out opendns servers to use as dns via its dhcp server - looks like you might be doing that but can not really tell for sure. Or you can have your clients still use your router and have it forward to opendns servers.

What does this mean?

Use discovered only sounds like it will be using your ISP dns? Does it hand that out to your dhcp clients, or hand out the 2 you have listed there - opendns?

When you hand it out - then your clients dhcp lease has to be updated to get the new info. Or they will still be using your router or isp dns and not be filtered. release and renew the lease on the client or reboot should do it as well.

Dynamic dns has little to do with your clients using opendns - now if your ip changes your categories and stuff will not be used. But how often does your public IP change? Do you turn off your router for days at a time? If not then should stay the same even if dhcp.

Nothing is filtered unless you actually use the opendns server for your dns, and if you don't flush your local cache on your box then you could still get to porn sites if you have them cached locally until the ttl expires.

[Koshur]

Hi Budman

Use discovered only sounds like it will be using your ISP dns? Does it hand that out to your dhcp clients, or hand out the 2 you have listed there - opendns?

-- All my clients get the dns servers that i list here. i.e OpenDNS and not my ISP DNS.

Here is the other option that says Auto discovery of DNS

I have a dynamic IP, whihc is why i added the my network in opendns dashboard.

Here is what i followed for ddclient config settings

/etc/ddclient.conf:
daemon=300
syslog=yes
mail=root
mail-failure=root
pid=/var/run/ddclient.pid
ssl=yes
use=web, web=myip.dnsomatic.com
protocol=dyndns2
server=updates.opendns.com
login=your_email_address_registered_with_OpenDNS
password=your_OpenDNS_password
Your_OpenDNS_network_label
/etc/default/ddclient:
run_ipup="false"
run_daemon="true"
daemon_interval="300"
[/CODE]

Just to rewind.. All filtering and policies work flawless on win 7 (purchased dyndns pro account - my router offer support for that). All win machine on network are now filtered. but as soon as i boot to ubuntu and try to debug by ddclient it throws error. Here is the error i get on debug - http://www.linuxques...problem-532194/

Unfortunately using -force option didnt help.

Also i followed this(https://help.ubuntu....nity/DynamicDNS) to cross check my settings for ddclient.

One more thing, i tried dnsomatic instead of opendns to update my IP but no luck there, i cant get my IP updated so that it sync's to the filtering policies.

[+BudMan MVC]

What???

You sure and the hell do not need to have you dhclient login into opendns

Once you setup your IP on opendns -- is it changing like very freaking minute or something?? Then you don't have worry about it.

Setup your public IP in opendns - then tell your clients to use opendns, or your router that forwards to opendns and your done! You can have any client on your network keep your dynamic IP updated with opendns using their client software if your router does not support it.

Do you not have Any windows clients or mac clients somewhere on your network??

But you don't have to worry about that for a while - my dynamic IP has not changed in 6 months, and only reason it did then was I changed the mac my cable modem was seeing from my physical router to a VM one, etc.

I have had the same dynamic IP for years some times.

[Koshur]

As far as i can tell, my ip changes at least twice in 24 hours! (or is there is a standard method to check this), and also when i drain and reboot my router (plug out the ADSL) i get a new IP everytime.

daemon=300

- did not change this value for ip renewal, just copied it for testing.

You can have any client on your network keep your dynamic IP updated with opendns using their client software if your router does not support it.

Thats right, and they suggest using ddclient for linux platforms.

Do you not have Any windows clients or mac clients somewhere on your network??

Yes i have two machine running windows, but i want to monitor a linux based machine that my brother uses. Once i test it on my linux machine, i'll configure his too to use ddclient (i have a dual boot), which is y m stuck with ddclient.

Senario 2- when i use a premium service from Dyndns. (my router CAN forward to DYNDNS.COM)

>i add my network there.

>apply content filtering (a defense plan - DF1)

>and add my credientials (hostname, username, email and pswd) on router page.

> Replace my current DNS resolvers with the following on the router :

216.146.35.35

216.146.36.36

Now when i do all this, the filtering and rules apply instantaneoulsly to all Windows machines(for both opendns and dyndns). But not on linux clients.

Tried blocking last.fm and it worked on win clients!!

[+BudMan MVC]

"but i want to monitor a linux based machine that my brother uses"

What does that have to do with anything?? Your all using this shared 59.177 address to access the internet are you not? So does not matter how many clients you have behind that - to opendns all queries come from this public IP.

If your isp changes your IP every time you reboot your router that is CRAZY!! But sure could happen. But to get it working and verify your filtering I think you have a few hour window where your public IP does not change.

And then you only need 1 box on your network to update IP. I don't see how your dhclient on nated box is going to work with changing your IP on opendns. It gets its IP from your router or other dhcp server on your network and going to get a private IP. dhclient would work if the box was directly connected to the public net.

Get it working before you worry about your dynamic public IP changing.

Once you have it working then you can work out how to keep opendns updated when your public IP changes.

[Haggis Veteran]

As long as you have an always on Windows lcient install the software to update IP there

i use DDclient as its a pain in the arse

Update the ip pn the opendns site and the change the DNS servers on your ubuntu box (the one that needs filtered) to the Opendns DNs Servers

This sometimes takes longer than 3 mins to get going

i use opendns to filter my network and also set it up for my sisters network too its great

[+BudMan MVC]

oh my bad, I read ddclient as dhclient ;)

Sure you can use ddclient on a linux box on your network to update opendns. But why not just use one of your windows box - much simpler!!

http://www.opendns.c...ort/article/101

Are you currentlly using dnsomatic? I believe you can use that to update opendns, so you would not need ddclient running on a linux box on your network.

Like I said lets get it working - then you can worry about updating your dynamic IP.. Just refrain from rebooting your router for a few minutes so your IP doesn't change ;)

You can always update your IP via their website on opendns if need be.

edit:

If your router supports dnsomatic, or you update it with ddclient or windows client, script, etc.. It can auto update opendns for you - no need to point ddclient to opendns, or run opendns client on windows box in your network, etc

[jnelsoninjax]

If you are using windows, OpenDNS offers a program for those who have dynamic IP address's, you can download it here

[Koshur]

oh my bad, I read ddclient as dhclient ;)

Sure you can use ddclient on a linux box on your network to update opendns. But why not just use one of your windows box - much simpler!!

http://www.opendns.c...ort/article/101

Are you currentlly using dnsomatic? I believe you can use that to update opendns, so you would not need ddclient running on a linux box on your network.

Like I said lets get it working - then you can worry about updating your dynamic IP.. Just refrain from rebooting your router for a few minutes so your IP doesn't change ;)

You can always update your IP via their website on opendns if need be.

edit:

If your router supports dnsomatic, or you update it with ddclient or windows client, script, etc.. It can auto update opendns for you - no need to point ddclient to opendns, or run opendns client on windows box in your network, etc

Ok. going with the dnsomatic this time. Ive skipped ddclient for now. I am assuming the dsnomatic would do the job of ddclient.

Here is what ive setup now.

1- 208.67.222.222 and 208.67.220.220 as my DNS servers on routers page

2- Added network as "Home" on opendns

3- Synced my Opendns account with Dnsomatic here:

4- Blocked last.fm on content filtering

5 - Here is what my Linux box see as DNS servers in connection information (I am connected on wifi and not LAN)

After all this i rebooted the my linux client and tried to access the blocked site "last.fm". And i can still access it. :((

NOW here is the funny part. Again its working on my win machines. I checked it within the VMware (win xp) which is in a bridged mode on this very linux machine. !!.

This thing is really annonying me. Dont know what i am missing..loosing my kool on this one... :/

If you are using windows, OpenDNS offers a program for those who have dynamic IP address's, you can download it here

All good on win clients but not on linux.

[+BudMan MVC]

Dude its simple enough to test - from your linux box query opendns for the domain you have blocked.

Here I don't even use opendns and it took me 2 seconds to get that domain blocked if I would use it.

And I am not updating my dynamic IP ;)

Notice the IP returned when I query opendns server directly for last.fm

Notice the IP returned when I query my router that is using my isp dns.

Now here is same test of one of my linux boxes on my network

Now my linux box is running bind and goes direct to roots for dns. Which is why I pointed to localhost for dns query.

from your linux box do a ping of last.fm what does it reply?? If the correct IP, then is it cached? Do a dig +trace to see where its getting dns from. Do the simple test I did with dig or nslookup

Is your linux box browser using a proxy? You sure your browser doesn't have it cached? All you have to do is simple dns query to verify if opendns block has been enabled or not.

[Koshur]

from your linux box do a ping of last.fm what does it reply?? If the correct IP, then is it cached? Do a dig +trace to see where its getting dns from. Do the simple test I did with dig or nslookup

Here is the output:-

You were right, the culprit is the dnscache, its still getting cached from my ISP DNS servers. 59.179.243.70

I Tried to clear cache(on root prompt) using

/etc/rc.d/init.d/nscd restart
[/CODE]

but i get the error that nscd does not exist, while i can see it in synaptic manager here:

Is your linux box browser using a proxy? You sure your browser doesn't have it cached? All you have to do is simple dns query to verify if opendns block has been enabled or not.

Nope.. No proxy on linux box

HANG ON there... found the correct command to flush dns cache. Flushed the cache and ran a dig on last.fm. Here is the output this time:

What could be going wrong now. ?

Edited November 14, 2012 by Koshur

[+BudMan MVC]

well your last couple of command were wrong!

You were trying query last.fm as your nameserver with that @ in front of it

just do dig last.fm

what does that respond with.

the @ tells dig to ASK that server or IP for the record after.. For example

dig last.fm

would ask whatever your box is set for dns for the record last.fm

dig @last.fm would ASK last.fm for nothing - so if was a dns server then it would return roots most likely.

drop the @ from your dig last.fm command and what does that return now - and then check if blocked via your browser

So for example duplicated your command but used the opendns IP, which is a dns server

dig @208.67.222.222

; <<>> DiG 9.8.1-P1 <<>> @208.67.222.222
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 7587
;; flags: qr rd ra; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;.							  IN	  NS

;; ANSWER SECTION:
.					   518400  IN	  NS	  c.root-servers.net.
.					   518400  IN	  NS	  f.root-servers.net.
.					   518400  IN	  NS	  e.root-servers.net.
.					   518400  IN	  NS	  h.root-servers.net.
.					   518400  IN	  NS	  l.root-servers.net.
.					   518400  IN	  NS	  a.root-servers.net.
.					   518400  IN	  NS	  i.root-servers.net.
.					   518400  IN	  NS	  b.root-servers.net.
.					   518400  IN	  NS	  m.root-servers.net.
.					   518400  IN	  NS	  d.root-servers.net.
.					   518400  IN	  NS	  j.root-servers.net.
.					   518400  IN	  NS	  g.root-servers.net.
.					   518400  IN	  NS	  k.root-servers.net.

;; Query time: 81 msec
;; SERVER: 208.67.222.222#53(208.67.222.222)
;; WHEN: Wed Nov 14 11:06:32 2012
;; MSG SIZE  rcvd: 228

problem is when your last command that last.fm is NOT a nameserver ;) Now if you want to query the last.fm nameservers directly you could do that with.

; <<>> DiG 9.8.1-P1 <<>> @ns1.cbsig.net last.fm
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 62032
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 4
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;last.fm.					   IN	  A

;; ANSWER SECTION:
last.fm.			    3600    IN	  A	   195.24.232.203

;; AUTHORITY SECTION:
last.fm.			    259200  IN	  NS	  ns1.cbsig.net.
last.fm.			    259200  IN	  NS	  ns5.cbsig.net.
last.fm.			    259200  IN	  NS	  ns2.cbsig.net.
last.fm.			    259200  IN	  NS	  ns4.cbsig.net.

;; ADDITIONAL SECTION:
ns1.cbsig.net.		  604800  IN	  A	   170.20.0.16
ns2.cbsig.net.		  604800  IN	  A	   170.20.0.17
ns4.cbsig.net.		  604800  IN	  A	   64.30.236.14
ns5.cbsig.net.		  604800  IN	  A	   64.30.236.15

;; Query time: 39 msec
;; SERVER: 170.20.0.16#53(170.20.0.16)
;; WHEN: Wed Nov 14 11:09:26 2012
;; MSG SIZE  rcvd: 186

ns1 - ns5.cbsig.net are the authoritative servers for last.fm domain.

[Koshur]

Here is the output for dig last.fm

umayrz@umayrz-HP-ProBook-4530s:~$ dig last.fm
; <<>> DiG 9.8.1-P1 <<>> last.fm
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 47297
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;last.fm.   IN A
;; ANSWER SECTION:
last.fm.  15 IN A 195.24.232.203
;; Query time: 14 msec
;; SERVER: 59.179.243.70#53(59.179.243.70)
;; WHEN: Wed Nov 14 23:04:01 2012
;; MSG SIZE  rcvd: 41
umayrz@umayrz-HP-ProBook-4530s:~$
[/CODE]

SInce dnsomatic still shows" waiting for first update"

I am also looking at this article(http://www.opendns.c...port/article/92), Tried updating through a URL

"[color=#2C3034][font=Arial, Helvetica, sans-serif]Note: The URL to use to send an IP address update to OpenDNS is:[/font][/color]

[color=#2C3034][font=Arial, Helvetica, sans-serif]https://updates.opendns.com/nic/update?hostname="[/font][/color]

It returned as - [color=#000000]good 59.177.xxx.xx[/color]

Edited November 14, 2012 by Koshur

[+BudMan MVC]

Look what server you asked in that lookup

59.179.243.70

That is not opendns - so no your not going to be blocked! Your box has to ask opendns server for last.fm, or they have to ask something that asks opendns for last.fm if you your asking

59.179.243.70

Then no **** its going to return the IP for last.fm not a block IP that points you to opendns block page.

Thought you set your linux box to use opendns -- clearly its not, since from your query it asked

;; Query time: 14 msec

;; SERVER: 59.179.243.70#53(59.179.243.70)

;; WHEN: Wed Nov 14 23:04:01 2012

;; MSG SIZE rcvd: 41

I would assume that is your isp dns?

How did you change what dns to use? And what linux OS are you running? ubuntu, centos, redhat, mint? Lots of people have issues changing their linux dns servers since they are unaware that changes in say resolv.conf get over written, etc.

But clearly you not asking opendns for last.fm from that command - so no your not going to get blocked!

As to why dnsomatic is not updating - what did you setup to update dnsomatic? your router? Did your IP change? If not then it prob not going to update dnsomatic.

edit: so I edited my linux dns to point to opendns, now I do a simple dig and you notice the server it asked

budman@ubuntu:~$ dig last.fm

; <<>> DiG 9.8.1-P1 <<>> last.fm

;; global options: +cmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 24472

;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:

;last.fm. IN A

;; ANSWER SECTION:

last.fm. 0 IN A 67.215.65.131

;; Query time: 36 msec

;; SERVER: 208.67.222.222#53(208.67.222.222)

;; WHEN: Wed Nov 14 14:41:44 2012

;; MSG SIZE rcvd: 41

from your command clearly your not asking opendns - so no your never going to get the wrong IP that points you to the block page.

[Koshur]

I would assume that is your isp dns?

Indeed SERVER: 59.179.243.70#53(59.179.243.70) is my ISP DNS.

How did you change what dns to use? And what linux OS are you running? ubuntu, centos, redhat, mint? Lots of people have issues changing their linux dns servers since they are unaware that changes in say resolv.conf get over written, etc. But clearly you not asking opendns for last.fm from that command - so no your not going to get blocked!

I am using Zorin 6 OS based on12.04. Not sure how would i make it update the resolvconf for DNS servers. Here is how i put my linux box on Open DNS. I believe this is how we do it??

And since my last screenshot about "connection information" shows this linux box getting OpenDNS servers, I assumed that i am running on open DNS unless it not actually getting updated in the some config file at the backend.

As to why dnsomatic is not updating - what did you setup to update dnsomatic? your router? Did your IP change? If not then it prob not going to update dnsomatic.

Nope. the IP has not changed, coz i left the router ON for overnight..I just added the service of OpenDNS family by logging in with opendns username and pswd. It showed up my network label i.e Home. and since then its "waiting for update', probably coz the ip has not changed since it added the service. I will reboot and see if it catches the new updated ip. If not autmatically, i am fine with running that update URL, whatever it takes to get it working..

[+BudMan MVC]

your set for dhcp - so it would more than likely just use what your dhcp tells it to use. Not what you set in there?? I don't run a linux gui, just shell so not sure where you would set it in gui.

I thought your router was suppose to be handing out opendns? Doesn't seem to be doing that either. Check one of your window boxes for ipconfig /all and it will show you what dns it got from your dhcp server?

example

Description . . . . . . . . . . . : Broadcom NetXtreme 57xx Gigabit Controller

Physical Address. . . . . . . . . : 00-1C-23-53-CF-38

Dhcp Enabled. . . . . . . . . . . : Yes

Autoconfiguration Enabled . . . . : Yes

IP Address. . . . . . . . . . . . : 10.56.41.187

Subnet Mask . . . . . . . . . . . : 255.255.255.0

Default Gateway . . . . . . . . . : 10.56.41.1

DHCP Server . . . . . . . . . . . : 10.56.144.21

DNS Servers . . . . . . . . . . . : 10.56.144.20

10.56.144.21

Primary WINS Server . . . . . . . : 10.56.144.11

Secondary WINS Server . . . . . . : 10.56.144.12

Lease Obtained. . . . . . . . . . : Thursday, November 15, 2012 9:52:48 AM

Lease Expires . . . . . . . . . . : Thursday, November 15, 2012 9:52:48 PM

If your linux box is dhcp - I would just fix your dhcp server (router) to make sure its handing out opendns.

[Koshur]

Just checked the ipconfig/all on my Desktop on the LAN (win client). Filtering woks well by the way.. last.fm is being successfully blocked on this one. Here is what it shows:

Ethernet adapter Local Area Connection:
		Connection-specific DNS Suffix  . :
		Description . . . . . . . . . . . : Marvell Yukon 88E8001/8003/8010 PCI
Gigabit Ethernet Controller
		Physical Address. . . . . . . . . : 00-14-85-9D-1D-45
		Dhcp Enabled. . . . . . . . . . . : Yes
		Autoconfiguration Enabled . . . . : Yes
		IP Address. . . . . . . . . . . . : 192.168.1.4
		Subnet Mask . . . . . . . . . . . : 255.255.255.0
		Default Gateway . . . . . . . . . : 192.168.1.1
		DHCP Server . . . . . . . . . . . : 192.168.1.1
		DNS Servers . . . . . . . . . . . : 208.67.222.222
		208.67.220.220
		Lease Obtained. . . . . . . . . . : Thursday, November 15, 2012 10:16:08 PM
		Lease Expires . . . . . . . . . . : Friday, November 16, 2012 10:16:08 PM
[/CODE]

My default gateway and DHCP server are both showing same value. Is that ok?

Here is what my router shows on:-

WAN setting page

LAN side:

DHCP pool summary

[color=#282828]I thought your router was suppose to be handing out opendns? Doesn't seem to be doing that either[/color]

My router only support Dyndns. I can try switching to that. However, currently with Open DNS, i though putting the DNS servers manually on the LAN side and syncing it on dsnomatic was what was needed. Although i do ran that IP updater URL but the status on dnsomatic still shows "waiting for update". The IP has changed by the way..

Sorry.. i am being a little too messed up here but this **** is driving me nuts and I am not the form the patient fellas. :/

[+BudMan MVC]

dyndns is not going to update opendns. You need something to update opendns, dnsomatic can do that for you - but you would have to run a dnsomatic client on some machine on your network if your router does not support dnsomatic. Or run the opendns client on some machine on your network

yes your gateway is going to be your router, and your router is your dhcp server - that is common config.

So did those dns come from your dhcp - or did you set them static in your windows. Windows allows you to easy set static dns while getting IP from dhcp. If it came from your dhcp server then linux should be getting it as well unless at somepoint you had set your isp dns statically on the box?

Clearly your linux box is not using opendns- it was using your isp dns. So it would not be blocked.

If your IP changed you better make sure that opendns reflects that change or even if your using opendns blocks wont work how you set them.

[xendrome]

I'm just curious, what does OpenDNS have to do with monitoring the traffic on your LAN?

[+BudMan MVC]

I would of used different subject as well - but he can use opendns to monitor top domains accessed.

Subject should be help with using opendns ;)

[smith.s]

Look@LAN Network Monitor. A free software to track lan traffic.