Solved

How to know who is uploading files on my network?

Posted on 2009-05-20
1
294 Views
Last Modified: 2012-06-27
Dears,

I have ISA server 2006, All users are connected to internet using web proxy client.

Is there is any way to know he is uploadung files in the current time.

Thank You
0
Comment
Question by:bateg
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
1 Comment
 
LVL 35

Accepted Solution

by:
Bembi earned 500 total points
ID: 24436985
You mean a user inside your network who is uploading files to the internet, right?

Uploading can happen via FTP or via HTTP. ISA has the oiption to generate detailed reports, where you can see, which IP address has which traffic on which protocol. This may be an indicator if you see larger traffic for an IP for FTP.

If a HTTP based tool is used (like some forums are using), it is quite more difficult to seperate usual HTTP traffic from file transfer traffic.You may have a look at the common traffic, if you feel that a user uploads larger amounts of files, you may have larger traffic for this ip.

With a little more work, you may import the Web traffic logs into a access database (or goto the SQL Database, if you log into SQL. As long as you have enable the s-operation and CS-URI field within the log, you can see the operation (Get or Post) and the full path to the target. If you find Post command there, you can identifiy the target as well as the IP of the client.

Not that POST command need not to be a upload, it can also be simply a passord.  But for them, you can also check the cs-bytes and sc-bytes fields to check, how many data is sent to get an idea, if this is a file or just a password.

0

Featured Post

Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Forefront is the brand name for Microsoft's major security product. Forefront covers a number of specific security areas and has 'swallowed' a number of applications under this umbrella including Antigen, ISA Server, the Integrated Access Gateway (t…
Microsoft's ISA Server has been its pre-eminent security product for about a decade and is still regarded amongst the well-informed as one of the best software firewalls and application gateways ever released, by any manufacturer. ISA Server has bee…
In this video, viewers are given an introduction to using the Windows 10 Snipping Tool, how to quickly locate it when it's needed and also how make it always available with a single click of a mouse button, by pinning it to the Desktop Task Bar. Int…
Add bar graphs to Access queries using Unicode block characters. Graphs appear on every record in the color you want. Give life to numbers. Hopes this gives you ideas on visualizing your data in new ways ~ Create a calculated field in a query: …

688 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question