Track YouTube

Bogdan Onishchenko

unread,

May 10, 2019, 1:56:27 AM5/10/19

to SELKS

Hi, is there any possibility to track which and how long person watched YouTube videos?

Alexander Nedelchev

unread,

May 10, 2019, 2:33:53 AM5/10/19

to SELKS

I think you need to discover how youtube delivers the streams and then look for a rule/way to catch it.

Peter Manev

unread,

May 13, 2019, 3:26:34 AM5/13/19

to Alexander Nedelchev, SELKS

On Fri, May 10, 2019 at 8:33 AM Alexander Nedelchev
<sa...@stamus-networks.com> wrote:
>
> I think you need to discover how youtube delivers the streams and then look for a rule/way to catch it.
>

Some ideas can be found here -
https://github.com/OISF/suricata-trafficid/blob/master/rules/traffic-id.rules
just FYI - This is already available in SELKS as part of the default ruleset .

> On Friday, May 10, 2019 at 8:56:27 AM UTC+3, Bogdan Onishchenko wrote:
>>
>> Hi, is there any possibility to track which and how long person watched YouTube videos?
>

> --
> IRC: Let's talk about SELKS on Freenode IRC on the #SELKS channel
> Wiki: https://github.com/StamusNetworks/SELKS/wiki
> GitHub: https://github.com/StamusNetworks/SELKS
> Blog: https://www.stamus-networks.com/theblog/
> Twitter: @StamusN
> g+: Stamus Networks
> ---
> You received this message because you are subscribed to the Google Groups "SELKS" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to selks+un...@googlegroups.com.
> To post to this group, send email to se...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/selks/69399032-44ac-4821-97b3-dd3233ad86dd%40googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.

--
Regards,
Peter Manev

Bogdan Onishchenko

unread,

Jun 20, 2019, 4:32:11 AM6/20/19

to SELKS

I've tried it and it doesn't work

On Monday, May 13, 2019 at 10:26:34 AM UTC+3, pevma wrote:

On Fri, May 10, 2019 at 8:33 AM Alexander Nedelchev
<sa...@stamus-networks.com> wrote:
>
> I think you need to discover how youtube delivers the streams and then look for a rule/way to catch it.
>

Some ideas can be found here -
https://github.com/OISF/suricata-trafficid/blob/master/rules/traffic-id.rules
just FYI - This is already available in SELKS as part of the default ruleset .

> On Friday, May 10, 2019 at 8:56:27 AM UTC+3, Bogdan Onishchenko wrote:
>>
>> Hi, is there any possibility to track which and how long person watched YouTube videos?
>
> --
> IRC: Let's talk about SELKS on Freenode IRC on the #SELKS channel
> Wiki: https://github.com/StamusNetworks/SELKS/wiki
> GitHub: https://github.com/StamusNetworks/SELKS
> Blog: https://www.stamus-networks.com/theblog/
> Twitter: @StamusN
> g+: Stamus Networks
> ---
> You received this message because you are subscribed to the Google Groups "SELKS" group.

> To unsubscribe from this group and stop receiving emails from it, send an email to se...@googlegroups.com.

Peter Manev

unread,

Jun 20, 2019, 5:20:25 AM6/20/19

to Bogdan Onishchenko, SELKS

On 20 Jun 2019, at 11:32, Bogdan Onishchenko <bofli...@gmail.com> wrote:

I've tried it and it doesn't work

Could you please share how you did it /set it up?

To unsubscribe from this group and stop receiving emails from it, send an email to selks+un...@googlegroups.com.

To post to this group, send email to se...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/selks/a4971b82-6679-4ef4-b2c1-b5cec054d272%40googlegroups.com.

Bogdan Onishchenko

unread,

Jul 11, 2019, 3:34:23 AM7/11/19

to SELKS

Screenshot_1.png

Peter Manev

unread,

Jul 12, 2019, 3:48:22 AM7/12/19

to Bogdan Onishchenko, SELKS

On Thu, Jul 11, 2019 at 10:34 AM Bogdan Onishchenko
<bofli...@gmail.com> wrote:
>

Sorry - i just see a screenshot attached ?

--
Regards,
Peter Manev

Bogdan Onishchenko

unread,

Jul 12, 2019, 4:39:31 AM7/12/19

to SELKS

Yes. i've sent you only a screenshot. I don't know what else to show

Peter Manev

unread,

Jul 12, 2019, 5:48:22 AM7/12/19

to Bogdan Onishchenko, SELKS

On Fri, Jul 12, 2019 at 11:39 AM Bogdan Onishchenko
<bofli...@gmail.com> wrote:
>
> Yes. i've sent you only a screenshot. I don't know what else to show
>

This basically tracks the you tube sessions but it would be difficult
to tie it to a person. you could use that rule and add some threshold
to it (to track time -
https://suricata.readthedocs.io/en/suricata-4.1.4/rules/thresholding.html?
) but you would still need to map IP to user for example.

> On Friday, July 12, 2019 at 10:48:22 AM UTC+3, pevma wrote:
>>
>> On Thu, Jul 11, 2019 at 10:34 AM Bogdan Onishchenko
>> <bofli...@gmail.com> wrote:
>> >
>>
>>
>> Sorry - i just see a screenshot attached ?
>>
>> --
>> Regards,
>> Peter Manev
>

> --
> IRC: Let's talk about SELKS on Freenode IRC on the #SELKS channel
> Wiki: https://github.com/StamusNetworks/SELKS/wiki
> GitHub: https://github.com/StamusNetworks/SELKS
> Blog: https://www.stamus-networks.com/theblog/
> Twitter: @StamusN
> g+: Stamus Networks
> ---
> You received this message because you are subscribed to the Google Groups "SELKS" group.

> To unsubscribe from this group and stop receiving emails from it, send an email to selks+un...@googlegroups.com.

> To post to this group, send email to se...@googlegroups.com.

> To view this discussion on the web visit https://groups.google.com/d/msgid/selks/786e92b7-06f2-4ad2-972a-975d51a93033%40googlegroups.com.

Reply all

Reply to author

Forward