network monitoring software

[rookie1010]

Hello
I was wondering if there is any network monitoring software around.

I mean say if isomeone was to copy files to his/her A drive or USB stick would a network admin know about it

how about if i disconnect from the network and then copy the files, would a network admin know about it.

if there is a software/method on the net, can you point me to its url?

 

[Rogue]

About all you could see is what data went to which IP address, beyond that, the data leaves the network card and moves to the hard drive where it's no longer monitored by the network. You could also naturally see when they connect/disconnect from the network, but again, that's about it. This can be done using a combination of RADIUS, sFlow and various other methods usually reserved for high end switches and routers. If you're asking this about a home Linksys, Belkin, etc. switch, you're pretty much SOL.

 

[rookie1010]

so if i have a local user saving data from his hard disk to a USB drive or an A drive, there is no way i would know?

 

[nick128]

nope, not without recording keystrokes or removing the floppy and disabling the extra USB ports ( or all of them ).

 

[rookie1010]

so i could have a keystroke logger installed in all my network and then analyse the keystrokes throug another software?

 

[ScottMac]

Yes, software monitoring is possible, it's done all the time. Every time you access (or update) a file it's recorded in the OS (Windows anyway).

Specific actions can be set to be monitored and recorded. Source, destination, date, time ...

If you want to see a basic example, go to "Install/Uninstall Software" in the control panel; it will tell you that an application has been "frequently" accessed, "Rarely accessed" etc.

Some of the Windows tools will give you "Last Accessed"

Network monitoring tools wills give all the specifics. In a commercial environment, stuff like that is necessary for license maintenance and to keep the employees from stealing software.

Then there's the flavor of monitoring software that let's them watch you as you work (a screen repeater, monitor, and recorder) that you'd use on a suspicious employee to gather evidence for termination.

So, yes, there is: what was it you're intending to steal?

Good Luck

Scott

 

[Rogue]

There is also a policy (registry entry) that you can set on WinXP SP2 to disable the use of USB storage devices at the OS level. I'm not sure if you can set permissions on it to permit only certain people to use them based on their group affiliation or not (regedt32 maybe), but it's another option.

 

[JackMDS]

There is also Network admin Rules that someone might get fired if he violates them.

:sun:

 

[rookie1010]

i was planning to copy all the files on all the servers (thought it would generate too much traffic though )

 

[nweaver]

?? All the files on all the servers to your local thumbdrive? That probably would generate a huge amount of traffic. It still sounds like maybe you are trying not to get caught....

also, using 3rd party software (such as altiris stuff) you can watch what is happening. You can use policies to lockdown/lockout functionality on a machine.

 

[rookie1010]

what is altiris?

 

[nweaver]

Altiris is enterprise level (ha) software that does everything from Imaging (like ghost, only on a larger scale, bit more scalable) to monitoring application usage, license compliance, locking out certain functions (such as can't launch Pinball.exe) and basiclly big brother stuff that companies need/want.

 

[rookie1010]

oh, sounds cool
wait till all network admin's hear about this

 

[imported_JFG]

wait until they find out much it cost and the training involved...

 

[nweaver]

Altiris imaging stuff isn't too complex. Their asset managment piece kicked my arse....

 

[mboy]

You can also block USB access in group policey (or anyting else you want to block access to) in2k/2k3 domains.

 

[nweaver]

group policy is a beast...it may tear you apart, but if you can learn/control, it is very powerfull.

 

[rookie1010]

i heard of something called netcop which could do pretty much the sam thing, USB, floppy drive blocking

 

[nweaver]

if you are using windows, and a domain, use group policy, it's a better solution, and you don't have to buy it or require 3rd party software.

 

[SectorZero]

Another alternative is Securewave.

http://www.securewave.com/home.jsp