Solved

How to know who is uploading files on my network?

Posted on 2009-05-20
1
288 Views
Last Modified: 2012-06-27
Dears,

I have ISA server 2006, All users are connected to internet using web proxy client.

Is there is any way to know he is uploadung files in the current time.

Thank You
0
Comment
Question by:bateg
1 Comment
 
LVL 35

Accepted Solution

by:
Bembi earned 500 total points
ID: 24436985
You mean a user inside your network who is uploading files to the internet, right?

Uploading can happen via FTP or via HTTP. ISA has the oiption to generate detailed reports, where you can see, which IP address has which traffic on which protocol. This may be an indicator if you see larger traffic for an IP for FTP.

If a HTTP based tool is used (like some forums are using), it is quite more difficult to seperate usual HTTP traffic from file transfer traffic.You may have a look at the common traffic, if you feel that a user uploads larger amounts of files, you may have larger traffic for this ip.

With a little more work, you may import the Web traffic logs into a access database (or goto the SQL Database, if you log into SQL. As long as you have enable the s-operation and CS-URI field within the log, you can see the operation (Get or Post) and the full path to the target. If you find Post command there, you can identifiy the target as well as the IP of the client.

Not that POST command need not to be a upload, it can also be simply a passord.  But for them, you can also check the cs-bytes and sc-bytes fields to check, how many data is sent to get an idea, if this is a file or just a password.

0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
TMG 2010 with OWA - HTTP Attacks 3 472
Server 2012 Domain Controler 4 454
How to remove PUP.Optional.MySearchDial A? 1 1,855
Exchange 2010 Edge Server and TMG Replacements 2 965
In Africa (and potentially where you live…), reliability of ISPs is questionable.  With the increased reliance on e-mail as one of the primary forms of communication, the costs to business are significant based on interuption of ISP Connectivity.  T…
Common practice undertaken by most system administrators is to document the configurations and final solutions of anything performed by them for their future use and reference. So here I am going to explain how to export ISA Server 2004 Firewall pol…
This tutorial gives a high-level tour of the interface of Marketo (a marketing automation tool to help businesses track and engage prospective customers and drive them to purchase). You will see the main areas including Marketing Activities, Design …
In this video I am going to show you how to back up and restore Office 365 mailboxes using CodeTwo Backup for Office 365. Learn more about the tool used in this video here: http://www.codetwo.com/backup-for-office-365/ (http://www.codetwo.com/ba…

920 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now