How to know who is uploading files on my network?

Dears,

I have ISA server 2006, All users are connected to internet using web proxy client.

Is there is any way to know he is uploadung files in the current time.

Thank You
bategAsked:
Who is Participating?
 
BembiConnect With a Mentor CEOCommented:
You mean a user inside your network who is uploading files to the internet, right?

Uploading can happen via FTP or via HTTP. ISA has the oiption to generate detailed reports, where you can see, which IP address has which traffic on which protocol. This may be an indicator if you see larger traffic for an IP for FTP.

If a HTTP based tool is used (like some forums are using), it is quite more difficult to seperate usual HTTP traffic from file transfer traffic.You may have a look at the common traffic, if you feel that a user uploads larger amounts of files, you may have larger traffic for this ip.

With a little more work, you may import the Web traffic logs into a access database (or goto the SQL Database, if you log into SQL. As long as you have enable the s-operation and CS-URI field within the log, you can see the operation (Get or Post) and the full path to the target. If you find Post command there, you can identifiy the target as well as the IP of the client.

Not that POST command need not to be a upload, it can also be simply a passord.  But for them, you can also check the cs-bytes and sc-bytes fields to check, how many data is sent to get an idea, if this is a file or just a password.

0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.