Logging Stream Traffic

Does anyone know of a premade product (or actionscript
technique) to track traffic to a stream? We would like to know: 1)
how many times a stream is initiated, 2) how many times the stream
is completely watched and 3) how long (time) the stream is watched
Ultimately we need to have a tracking mechanism to report on
pre-roll ad usage, but these same stats would be helpful for
general site traffic as well.

Check out Sawmill, which can read the W3C compliant logs from
FMS. It works for us. You'll need to create some custom filters to
get any useful reports, though. We still need to create filters
ourselves.
http://www.sawmill.net/

Similar Messages

Is there a way to log all traffic on a CAN port in VeriStand?

Hello,
I'm looking for a way to log all traffic on a given port in VeriStand. Basically I'd like to assign a DBC file to that port and then simply log everything but I can't see a way to do this in VeriStand. I've tried the Raw frame logging and choosing the "log entire bus traffic" option but end up with just a single channel "Engine Timestamp". I'm currently using the embedded data logger but that requires me to have imported the frames I want to log and the DBC file is simply too big for VeriStand, it doesn't seem to be particularily efficient at adding additional CAN frames and to try and add the entire DBC file essentially locks up VeriStand. Any suggestions or something I've simply missed? Thanks.
Post CLD and when I'm a CLA when someone asks who I am, I can spin around in my chair and say "I am... the architect."

Thanks for the update! If anyone else has the same question, the answer is that in order to extract the bus log information in the TDMS file, you should use the DIAdem Bus Log Converter tool. It is expected (though confusing) that the file looks mostly empty in the Data Portal until you use this tool to extract the information.
Also, this is a fantastic tutorial from a very bright engineer on how to correlate data from multiple sources, such as raw frame files, in DIAdem. Highly recommended reading. It also has some data on the bus log converter.
Jarrod S.
National Instruments

Logging GPRS traffic

Hi,
I want to make an application to log GPRS traffic.... please help me how to start.... And is that possible??

Hi,
It's not possible using Java ME. It's too highlevel language and environment.
You should use some low level APIs in your operating system (WM, Symbian...).
Rada

No ACL deny logs for Traffic not matched by Static Object NATs and ACL. Need Help.

I start noticing that I do not see any denied traffic coming in on my ACL. To better explain, lets say I have this config.
### Sample Config ###
object network webserver
host 192.168.1.50
nat (dmz, outside) static X.X.X.X service tcp www www
access-list inbound extended permit ip any4 object webserver eq www
If I generate a traffic from the outside let's say a traffic that is trying to access X.X.X.X via TCP Port 8080 which obviously does not have any NAT entry to it going to my DMZ, I don't see the ACL denies it anymore but instead comes back with a Drop Reason: (nat-no-xlate-to-pat-pool) . On the packet trace I got this. (Below) it seems that does not even hit the ACL as there is no xlate found for it, at least to what the drop reason says.
Phase: 1
Type: CAPTURE
Subtype:
Result: ALLOW
Config:
Additional Information:
MAC Access list
Phase: 2
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
MAC Access list
Phase: 3
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 0.0.0.0 0.0.0.0 Outside
Result:
input-interface: Outside
input-status: up
input-line-status: up
output-interface: Outside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (nat-no-xlate-to-pat-pool) Connection to PAT address without pre-existing xlate
Before, using a regular Static PAT on ASA Versions 8.2(5) below, I could get the deny logs (ASA-4-106023). Generally, I use these logs, and are quite important for us specially during auditing.
My question is how can I generate logs for these type of dropped traffic on the ASA 9.1 Version?
Any comments/suggestions are gladly appreciated :)
Regards,
John

I believe, but am not 100% sure, that the reason you are not seeing the ACL drop but a no NAT matched is because of the changes from 8.2 to 8.3 in the order of how things are done. In 8.3 and later you need to secify the real IP address when allowing packets in, and this is because NAT happens before the ACL is matched. So since there is no match on the NAT the packet is dropped then and there, never reaching the stage where ACLs are checked.
As to seeing drops in the ACL log...You might want to try adding an ACL that matches the NATed IP...but I don't think you will have much success with that either. My guess is that there is no way around this...at least no way I know of.
Please remember to select a correct answer and rate helpful posts

Missing /dev/log stream?

Hi All,
I just installed Solaris 10 onto a Sun Ultra 2 Enterprise box and I'm trying to get jailkit 1.3 to work. Upon starting jk_socketd, it's complaining that /dev/log doesn't exist and it wants that socket stream.
How do I create the socket stream device for /dev/log in Solaris 10?
Thanks!

What do you mean by handling the input buffering myself?
I'm basically doing
ObjectInputStream in = new ObjectInputStream(socket.getInputStream());
[\code]
and then i read the in stream.
Is that considered handling it myself?

Is there any way to log web traffic information of the users with RV082 router ?

Dear all,
I just bought a RV082 router. I can't find any way for logging the web traffic of the users.
Can it be done with the router ?
Thanks
Fabio

Hello,
If I am not mistaking the best you can do is to send syslog traffic to a server or locally (to a server being preferred) .
But you are going to see stuff like this:
30>Aug 3 22:12:40 2005 gw RGFW-OUT: ACCEPT (TCP 192.168.1.111:2101->212.5.219.46:80 on ppp0) [0,0]
<30>Aug 3 22:12:40 2005 gw RGFW-OUT: ACCEPT (TCP 192.168.1.111:2102->81.0.235.240:80 on ppp0) [0,0]
<30>Aug 3 22:12:40 2005 gw RGFW-OUT: ACCEPT (TCP 192.168.1.111:2103->81.0.235.251:80 on ppp0) [0,0]
<30>Aug 3 22:12:41 2005 gw RGFW-OUT: ACCEPT (TCP 192.168.1.111:2104->212.5.219.46:80 on ppp0) [0,0]
<30>Aug 3 22:12:41 2005 gw RGFW-OUT: ACCEPT (TCP 192.168.1.111:2105->81.0.235.250:80 on ppp0) [0,0]
<30>Aug 3 22:12:41 2005 gw RGFW-OUT: ACCEPT (TCP 192.168.1.111:2106->212.5.219.46:80 on ppp0) [0,0]
You will need an external device to make this happen, Having a proxy server such as Squid would do it for you and not just that but will optimize the newtork :)
Regards,
Jcarvaja
CCIE 42930

Access Log- Stream Play & Stream Stop

Hello, I am new to Flash. I have recently installed FMIS 3.5.3. In checking the access logs I find data in both logs that display the same stream stop and stream play time . I'm not sure why the time is the same (00:19:27 example below). Videos play fine when testing from work (T3 connection). However, occasionally a very slight hesitation when playing video from home (I have cable connection).
session    connect    2010-05-24    00:19:25    4576        3073    3073    -    -    -    -    200    -
stream    play    2010-05-24    00:19:25    4576        3261    3476    lets_drive/rules/Epilogue-Making_an_Appointment    0    15042753    85.681000    200    -
stream    stop    2010-05-24    00:19:27    4576        3346    500157    lets_drive/rules/Epilogue-Making_an_Appointment    521770    15042753    85.681000    200    -
stream    play    2010-05-24    00:19:27    4576        3346    500157    lets_drive/rules/Epilogue-Making_an_Appointment    0    15042753    85.681000    200    -
stream    stop    2010-05-24    00:19:27    4576        3346    527594    lets_drive/rules/Epilogue-Making_an_Appointment    1512    15042753    85.681000    200    -
stream    play    2010-05-24    00:19:27    4576        3431    527846    lets_drive/rules/Epilogue-Making_an_Appointment    0    15042753    85.681000    200    -
stream    stop    2010-05-24    00:19:27    4576        3516    654052    lets_drive/rules/Epilogue-Making_an_Appointment    139832    15042753    85.681000    200    -
stream    play    2010-05-24    00:19:27    4576        3516    654052    lets_drive/rules/Epilogue-Making_an_Appointment    0    15042753    85.681000    200
Thanks for reviewing and assistance.

Thanks for the reply Mamata,
I am using the VOD service to stream videos. I found some code on the adobe site (http://www.adobe.com/devnet/flash/articles/video_playlist.html) to work with playlist. I also use this code for launching individual movies (no playlist displayed). This playlist application uses a custom-made player.
I observed a video play without any problems (no hesitation) and then checked the access log:
session     connect     2010-05-24     12:24:42     3052          3073     3073     -      -     -     -     200     -
stream     play     2010-05-24     12:24:42     3052          3295     3476     media_even t/Sharing_the_Road_with_Motorcycles_Bicycles_500_2pass     0     38782649     343.248000      200     -
stream     stop     2010-05-24     12:24:42     3052          3397     211301     media_ev ent/Sharing_the_Road_with_Motorcycles_Bicycles_500_2pass     206987     38782649     343.2 48000     200     -
stream     play     2010-05-24     12:24:42     3052          3397     211301     media_ev ent/Sharing_the_Road_with_Motorcycles_Bicycles_500_2pass     0     38782649     343.248000      200     -
stream     stop     2010-05-24     12:24:42     3052          3397     217913     media_ev ent/Sharing_the_Road_with_Motorcycles_Bicycles_500_2pass     6368     38782649     343.248 000     200     -
stream     play     2010-05-24     12:24:42     3052          3499     218199     media_ev ent/Sharing_the_Road_with_Motorcycles_Bicycles_500_2pass     0     38782649     343.248000      200     -
Thanks,
Frank

Syslog: logging specific traffic only to syslog server

remote site is accessing onsite servers and need to lock them down based on host ip's and ports.
remote site connects to onsite network thru 6509 L3. want to capture remote traffic to syslog server. (only want to capture remote site traffic, no other traffic).
in order to "see" all traffic passing
"ip any any" required to determine what servers / services remote site is accessing for now. will "lock down" acl once all servers / services are identified.
how to direct only the remote site traffic to my syslog server?
acl 130 permit ip 172.16.3.0 range 1 65535 any
thx

Assuming your remote site is using IP addresses in the 172.16.3.0 subnet with a 255.255.255.0 subnet mask, and you apply your access-list 130 to inbound traffic on the VLAN interface that services them...
...just add the word "log" at the end of your ACL 130 commands. Also, make sure you have "logging x.x.x.x" in your config, where x.x.x.x is the IP address of your syslog server. It would look like this:
access-list 130 permit tcp 172.16.3.0 0.0.0.255 range 1 65535 any log
access-list 130 permit udp 172.16.3.0 0.0.0.255 range 1 65535 any log
access-list 130 permit icmp 172.16.3.0 0.0.0.255 any log
access-list 130 permit ip 172.16.3.0 0.0.0.255 any log
logging x.x.x.x
interface VLAN 163 (assuming that's your VLAN number)
ip access-group 130 in
Any hits on these lines including port numbers will show up in the syslog. You will probably get a lot of entries at first. You may want to fine-tune the ACL as you identify known services early on, so that access to them is still permitted but you don't necessarily log messages for it.

How do you log incoming traffic (SMTP) on a Cisco PIX 515E?

Hi Everyone,
I have a good one for you guys. I'm new to ASA's and PIX units. I've setup a few VPN's now but know next to nothing about logging on these units. I read the config guide for the PIX, but cannot figure out how to get a log of incoming SMTP traffic going on the console. Any ideas? Do I need to use a SYSLOG server? I can probably set one up on my laptop... Any replies would be appreciated. Thanks!

Hi,
Naturally a long term solution for gathering this information would be to send logs to a separate Syslog server.
On the syslog server you will have better tools to go through the logs than just looking at the log buffer on the CLI of the ASA/PIX or on the ASDM real time monitor.
The very basic "logging" configuration would be
logging on
logging timestamp
logging device-id hostname
logging trap informational (or notifications)
logging host
This would include only the logs for syslog server.
There are options to tweak the log output but the above is a pretty basic setting without any extra.
With the above configuration (logging trap informational) you would get logs of every connection formed and every connection teardown. You could then parse the logs for the log messages of SMTP (TCP/25) connections. Naturally this would also log same for translations and other information and depending on the size of the network or amount of the connections this might generate quite a lot of logs.
You can also configure a "log" keyword on "access-list" lines that permit traffic (SMTP in this case). You can also configure a non default "level" for the messages after the "log" keyword.
Most of our Syslog setups log with pretty basic configurations and we use the Syslog server to check for the logs we need.
Your logging setup/configuration naturally depends on your needs. Is it something needed for long term monitoring of connections or just for some quick troubleshooting purposes. Generally I think it would be good to keep logs of most things that happen on the firewall to help with troubleshooting etc.
- Jouni

Logging internet traffic

Is there anything in Leopard that allows me to track any external access from the internet?
I recently had my mailbox Hijacked on my ISP and somehow they managed to change the password on the webmail server and it appears used my email address to send the usual phishing crap. They didnt get it from me. I dont keep passwords on my Macs in plain language but I want to make sure that there has been no unauthorised activity from the net.
I dont open or respond to anything that I dont know or understand. I am morelikely to junk valid emails than open invalid stuff
Its not the first time that I have had issues with my ISP. Seems to me that they have been hacked esp as Comcast denies all emails from this ISP because quote"80% of emails from your part of the world are genreated by your ISP " unquote

If your Mac's firewall is off, turn it on.
Little Snitch might help you out:
http://www.obdev.at/products/littlesnitch/index.html
~Lyssa

Black box able to log traffic passing through...

Hi
I'm looking for a box able to sniff the tcp/ip traffic (source ip address, destination ip address and ports) passing from it's ingress interface to the egress interface and viceversa (useful the bypass option if this box fails) without any change of the traffic passing through, just logging it and sending this log to a syslog server.
We need it as solution to be compliant with the new police law against computer criminals where is written that all the internet traffic has to be logged (we offer sometimes transparent internet access to our customers where we do not put any kind of equipment as firewall, proxy or something else, only the router providing the internet access).
Do you know if Cisco provide something like that ? Other vendors ?
Any other idea how to be compliant with this request ?
Thanks
Pls advise
Ric

Cisco Intrusion Prevention System Sensor can be used to log ip traffic. You can manually configure the sensor to capture all IP traffic associated with a host you specify by IP address. You can specify how long you want the IP traffic to be logged, how many packets you want logged, and how many bytes you want logged. The sensor stops logging IP traffic at the first parameter you specify.You can also have the sensor log IP packets every time a particular signature is fired. You can specify how long you want the sensor to log IP traffic and how many packets and bytes you want logged

Logging Airport Web Traffic

Is there an easy way to log the traffic going through my airport express so that I know if someone is using my wireless network?
I've searched on syslog and otherwise seem to think I somehow need to send the info to some kind of server?
Thanks for any help,
Mark

How do I log to an IP address?
You need to setup a syslog server on your network that is configured to accept log messages from none-local devices.
Fortunately your Mac can act as a syslog server, although by default it only accepts local logs (from processes running on your own machine). You can follow the instructions on this page to enable remote logging.

Concentrator: User Traffic Logging

Hi,
is there a possibily to log the traffic generated by a VPN client user? Traffic means protocol, destination ip and port.
Something like netflow for users?
thx.
marco

Hi Waheed,
You can use Network Performance tools from Riverbed.
http://www.riverbed.com/products/
HTH

E3000 -- No OUTgoing traffic logged

I noticed that no OUTgoing traffic was being logged by my E3000. I tried WW and even sent some raw logs to the dev and he confirmed the same.
During a recent online chat with a Cisco|Linksys rep., I was told that the E3000 does NOT support logging of OUTgoing traffic at this time. He then mentioned that it might be available in a future FW update. My FW version is: 1.0.01 build 6 Apr. 15, 2010.
The reson I mention this is that I have been reading messages from users who have been logging OUTgoing traffic with their E1000 and E2000 routers. If this is the case, then is the E3000's firmware that different?
Flashfox

Working fine here... same firmware version, build 6.
Uploaded with ImageShack.us

Bytes in access.log

hi, When a JSP is accessed with a page size greater than 8.5 kb the access.log shows a entry of 0 bytes . Basically the same JSP is accessed with a few lines added .Why is the entry showing zero even the page is cached.thanks, Anita Sharon

Are you talking about access.00.log of AMS? If yes - then it will not log any traffic related to HTTP Streaming i.e. HDS and HLS. You would have to use access logs of Apache when it comes to analysis of HTTP traffic.

Logging Stream Traffic

Similar Messages

Maybe you are looking for