Generally speaking, routers are considered as "three-layer" devices, that is, they mainly realize the functions of TCP/IP Internet layer or OSI (far-fetched) network layer. Therefore, when the router receives the message that the host in the internal network accesses the external network, it only decapsulates it to the "Internet layer", that is, the router only pays attention to the source and destination IP address fields in the IP message and forwards it according to the routing table.

But routers also have operating systems (generally referred to as commercial routers, which are barely counted in China). Based on some factors (such as traffic classification, shaping, etc. ), the administrator can manually configure it to unpack it into some high-level protocols and formulate forwarding strategies.

Based on the above, it can be seen that the router is not a device specially used to analyze the online behavior of intranet users. The devices used to analyze online behaviors are generally called "online audit systems", such as Shen Xin and Netcom in China, which are all specialized in this kind of hardware devices.

If the landlord wants to check the online behavior of users in the intranet, he can deploy "port mirroring" on the link between the router and the intranet, usually to a port in the switch connected to the router, and connect a PC (or PC server) to this port (the IP address must be configured by himself). Then, a "message grabbing" tool (such as Wireshark, WildPacket, etc. ) can be installed on a PC to capture messages, and then according to the captured messages,

Note: It is dangerous to make changes at the Internet exit of the organization. Inadvertent operation, business interruption; If there are a large number of terminals in the organization, the landlord should pay more attention to using high-performance equipment to complete the analysis, otherwise it may seriously affect the business. In short, we must be careful in the production environment!

Welcome to continue asking questions.