Recommendation for Internet monitoring

[nettech98]

Small business LAN with fractional T1 into a Cisco 1720 router. One user is suspected of abusing his Internet priveledges. Management wants to monitor (and log) his Internet usage to decide if action is warranted.

They're looking for an inexpensive (probably means software-based) way to accomplish this. Suggestions?

I'm assuming that if we're in a switched environment, the Logging device will have to be on the same port as the suspect, or the same port as the router.

 

[miguel]

Probably the least expensive is to go to his PC after he leaves work and check it out. The PC does belong to the company, after all.

 

[Saltin]

How about looking in his cookies and temp internet files? I guess alot of user's are wise to this, but you could do it remotely while you suspect he is surfing whatever.....
Other than that, my best guess would be a proxy of some sort. I work with MS ISA here, which will give me a pie chart on a user's usage if I so desire, but its not cheap.
I know some of the guys around here will know of a free proxy......

 

[nettech98]

After I posted, I started looking around for myself. There some pretty cool 'spy' software out there. Check this out! This stuff is cheap - $40!

I'm still open to opinions/suggestions though...

 

[RagManX]

There are lots of ways to do this. You can put a hub off his switch port and plug in a sniffer (http://www.ethereal.com/ for free). You can use software keystroke monitoring (google search turns up plenty of these). You can use hardware keystroke monitoring (http://www.keyghost.com/). You can install a remote control app (VNC, PCAnywhere, etc) and disable security so you can connect and watch his screen at any time. You can go to his machine while he is there, and inspect his cache and cookies. It is a company machine, so this is perfectly within your rights as a representative looking for company asset abuse. Hook up a video camera in his area which can watch his system. See what the tape shows. Any of these may be illegal, so check with a lawyer first.

Before doing any of these, however, I would send out several emails over several days reminding users that the systems they are using are company property, and therefore subject to inspection any time management decides it is necessary. Send the email with read and delivery receipts, so you can track who is opening them. With several email, you reduce the risk someone could claim that they didn't know, and thus take you/the company to court over any disciplinary actions taken against the employee.

RagManX