Solved

How to know who is uploading files on my network?

Posted on 2009-05-20
1
293 Views
Last Modified: 2012-06-27
Dears,

I have ISA server 2006, All users are connected to internet using web proxy client.

Is there is any way to know he is uploadung files in the current time.

Thank You
0
Comment
Question by:bateg
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
1 Comment
 
LVL 35

Accepted Solution

by:
Bembi earned 500 total points
ID: 24436985
You mean a user inside your network who is uploading files to the internet, right?

Uploading can happen via FTP or via HTTP. ISA has the oiption to generate detailed reports, where you can see, which IP address has which traffic on which protocol. This may be an indicator if you see larger traffic for an IP for FTP.

If a HTTP based tool is used (like some forums are using), it is quite more difficult to seperate usual HTTP traffic from file transfer traffic.You may have a look at the common traffic, if you feel that a user uploads larger amounts of files, you may have larger traffic for this ip.

With a little more work, you may import the Web traffic logs into a access database (or goto the SQL Database, if you log into SQL. As long as you have enable the s-operation and CS-URI field within the log, you can see the operation (Get or Post) and the full path to the target. If you find Post command there, you can identifiy the target as well as the IP of the client.

Not that POST command need not to be a upload, it can also be simply a passord.  But for them, you can also check the cs-bytes and sc-bytes fields to check, how many data is sent to get an idea, if this is a file or just a password.

0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
switch connecting to ISA server 8 330
Sharepoint 2010 External Login Throught Citrix Netscaler 4 1,159
OWA (external) domain prefix removal 2 55
Threat Management Gateway 2010 + RSA 3 177
In all versions of ISA Server and the current version of FTMG, the default https protocol uses TCP port 443 and 563 only. This cannot be changed within the ISA or FTMG GUI and must be completed from a Windows cmd prompt on the ISA Server itself. …
So the following errors occurs in 2 ways that I am aware of at this stage, and you receive one of the following error messages: ERROR 1. When trying to save a rule: No Web listener is specified for the Web publishing rule Autodiscovery Publishin…
Are you ready to implement Active Directory best practices without reading 300+ pages? You're in luck. In this webinar hosted by Skyport Systems, you gain insight into Microsoft's latest comprehensive guide, with tips on the best and easiest way…

730 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question