Hi,

We have installed a new student server in our department. The institute is behind a firewall and so all the connections to the internet go through that firewall. Since the server is wholly for the students and managed by students, I have been made the associate system administrator.

The problem is that there are numerous incidents occuring when peer students are accessing banned sites. I have been retrieving the list of such sites and adding them to the deny access list. However, that is not a final end to the problem. Further, the students whose logins have been caught, when questioned denied the facts and some of them have given their logins to other friends who might be accessing these sites.

The system runs Red Hat Linux 7.0 and I have tried various system processes (top et al) but have had little success with it. The main problem is identifying from where the access is being made and identifying the data that is being exchanged (some students tried to use anonymous proxy servers); in case someone is sitting in the department lab on the terminals connected to that server, he can be caught and warned thus reducing such incidents in future.

I have talked to my professors and they only gave me some pointers about packet sniffing and packet filtering asking me to find it out for myself. They said it will give me real time information on who is accessing what and thus I can immediately get to know on which term someone is accessing a banned site and thus lock his login there and then and catch him on the spot. I have tried looking about these terms on the net but they are all usually software tools which too are windows based.

Can anyone tell me where to find information on how to do packet sniffing and packet filtering for linux without having to download any softwares. Also, if there is any other method to know which sites are being accessed, it would make my work a lot easier.

Thanks.

Regards,
Bluzky.