Solved

How to know who is uploading files on my network?

Posted on 2009-05-20
1
285 Views
Last Modified: 2012-06-27
Dears,

I have ISA server 2006, All users are connected to internet using web proxy client.

Is there is any way to know he is uploadung files in the current time.

Thank You
0
Comment
Question by:bateg
1 Comment
 
LVL 35

Accepted Solution

by:
Bembi earned 500 total points
ID: 24436985
You mean a user inside your network who is uploading files to the internet, right?

Uploading can happen via FTP or via HTTP. ISA has the oiption to generate detailed reports, where you can see, which IP address has which traffic on which protocol. This may be an indicator if you see larger traffic for an IP for FTP.

If a HTTP based tool is used (like some forums are using), it is quite more difficult to seperate usual HTTP traffic from file transfer traffic.You may have a look at the common traffic, if you feel that a user uploads larger amounts of files, you may have larger traffic for this ip.

With a little more work, you may import the Web traffic logs into a access database (or goto the SQL Database, if you log into SQL. As long as you have enable the s-operation and CS-URI field within the log, you can see the operation (Get or Post) and the full path to the target. If you find Post command there, you can identifiy the target as well as the IP of the client.

Not that POST command need not to be a upload, it can also be simply a passord.  But for them, you can also check the cs-bytes and sc-bytes fields to check, how many data is sent to get an idea, if this is a file or just a password.

0

Featured Post

Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

Join & Write a Comment

I have been asked to explain on many, many occasions the correct way to setup network cards and DNS settings on ISA Server 2004, 2006 and forefront Threat management gateway (FTMG) and have willing done so. I have also promised my self everytime tha…
Forefront Threat Management Gateway 2010 or FTMG comes with some very neat troubleshooting tools built-in when trying to identify what is actually happening behind the scenes within the product when traffic is passing through its interfaces. To the …
This video explains how to create simple products associated to Magento configurable product and offers fast way of their generation with Store Manager for Magento tool.
You have products, that come in variants and want to set different prices for them? Watch this micro tutorial that describes how to configure prices for Magento super attributes. Assigning simple products to configurable: We assigned simple products…

746 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now