Squid Proxy: Monitoring traffic to a particular site

[shri19]

Hi all,

Is there any way to monitor traffic to specific sites in runtime in squid proxy, so that we can use this information to take required actions. Like for example i would like to keep track of number of download requests to a particular site and block it for a while if it crosses a certain threshold.

Please let me know if there's any way of doing this.

Thanks in advance.

[cyberinstru]

Hi -

check out for url_rewrite_program directive and usage in Squid configuration. This directive helps to hit HTTP request to an external program where you can put in the logic for hit count and redirection and what not.

HTH.

[ioanna83]

do you need this automated? you will need some custom written scripts

For stats you can use:
MySAR | Production Monkeys

for filtering you can use dansguardian:
DansGuardian - True Web Content Filtering for All

[shri19]

@cyberinstru: thanx for the info. I think url_rewrite_program will be useful.

@ioanna:
Actually I am looking a way to solve the systematic download problem, i.e., the institute network provides free access to all the journal sites like IEEE etc, But there are some who write a simple shell script and download thousands of documents in a day. So i need something which will look keep track of pdf download requests over a time window and take some necessary action if these requests cross a certain threshold. If you have anything to solve the problem please let me know.

One more issue is checking if the request is pdf download request. The sites use dynamic URl's, so I think it's not possible to say something just by looking at the URL, Is there any way to know this?

Thanks.