TR Forums

Can anyone suggest a simple logging proxy for at least HTTP, maybe DNS too, on Windows?

Nothing fancy or complex, I mainly want to see requests, and maybe responses.

Well, it may violate your "nothing complex" requirement, but there are almost certainly Cygwin ports of multiple packages that can do stuff like this...

Indeed sounds messier than I'd like, but which specific ones do you have in mind?

A few months ago I wanted to have something similar. I don't remember what the software was, but I think the "logging" part ended up being Wireshark, and that wasn't much fun.

I've used Squid on Linux and FreeBSD to do similar things. There's a Squid port that runs on Windows. While I've not run it on Windows, it does appear to have some decent Windows integration, like the ability to run as a service.

Squid has a lot of capabilities that you won't need (reverse proxy, caching, etc.), but it will do what you want to do and do it for free.

Thanks.

I checked Squid briefly. It can't do a transparent proxy on Windows because stock Windows doesn't let things capture all traffic from the NIC. There are some mentions of using 3rd party tools + unclear procedures to get Squid to do it, but I moved on.

I found WinGate, which should do everything, in theory. But beyond getting it to act as a DHCP server I can't get it to do much. With Wireshark I actually don't see much activity from the network device I want to watch; just some ARP and general SSDP broadcasts. Not sure what's to blame. Windows' network stack GUI and configurability is still severely lacking, so maybe something is tripping over itself.

So a new idea. Can anyone suggest a GUI-oriented LiveCD Linux distro that comes stock with a logging gateway/NAT?

meerkt wrote:

I checked Squid briefly. It can't do a transparent proxy on Windows because stock Windows doesn't let things capture all traffic from the NIC. There are some mentions of using 3rd party tools + unclear procedures to get Squid to do it, but I moved on.

While this may indeed be a limitation of Squid on Windows, it isn't because Windows forbids capture of all traffic on the interface. Wireshark and NIC virtualization (as used by VMware/VirtualBox/etc.) both rely on being able to access the raw packet traffic on the interface (a.k.a. promiscuous mode).

Sure, but they require drivers for that. Squid-for-Windows could have used something like WinPcap, but Windows is far from a primary target, so not much development activity there.

Ugh. WinGate does work. I thought it seemed odd I get ARP and DHCP but not DNS. It was a firewall rule blocking UDP selectively.

WinGate's logging leaves a lot to be desired, but it's nothing you can't solve with tedious manual work.

meerkt wrote:

Can anyone suggest a simple logging proxy for at least HTTP, maybe DNS too, on Windows?

Nothing fancy or complex, I mainly want to see requests, and maybe responses.

Simple, easy proxy? You want Polipo. There's a windows version in the download section of the propject website. Of course, you can just run it on a dinky ubuntu VM in Virtualbox, but then it's not as simple anymore, is it?

Polipo is a small and fast caching web proxy (a web cache, an HTTP proxy, a proxy server). While Polipo was designed to be used by one person or a small group of people, there is nothing that prevents it from being used by a larger group.

Thanks. I actually tried Polipo, but like Squid, no promiscuous mode. On a brief look I didn't find request logging. But on the plus side, it's small and simple to "install".

But WinGate did the job. Trying to see now if I could use it to feed modified documents from the cache.