RE: [Ntop] Possible to produce reports on host Internet history?

Wed, 28 Jan 2004 13:49:11 -0800

I see that paper now -- I hadn't even been to ntop's sf.net site yet, so that's probably how I missed it (never saw it).  As far as ALWAYS tracking / logging where veryone has gone, that's not what I need.  Here is a scenario:
 
Manager X comes to me and says "We need to find out what kind of Internet browsing activity employee Z is doing on a regular basis -- we believe employee Z is wasting a lot of time at site X and not getting work done."  So I start tracking / monitoring the host of this user for a few days to be able to provide a record of what this user has been doing / where they have been going.
 
Pretty much that Is all that is needed -- nothing more.  I care not to keep a full detailed history of all hosts at all times -- even for a week or so.  I realize that the only real feasible way to track someone is to set it up on request, and only for a definite period of time given how logs would eventually get way out of hand.
 
I'll read over this rrd paper and try to see if I can pull whatever details I can from it to do what I need to.
-----Original Message-----
From: Burton M. Strauss III [mailto:[EMAIL PROTECTED]
Sent: Wednesday, January 28, 2004 12:16 PM
To: [EMAIL PROTECTED]
Subject: RE: [Ntop] Possible to produce reports on host Internet history?

How about reading the documentation that's available?  I know there's not much, but one of the few things that DOES exist is the "ntop and rrd" paper at SourceForge.
 
As to the other, well, ntop is a network traffic monitor, not a forensic tool.  If you think about it, it takes enough storage now to hold a single dimensional (sent/received) view of the hosts - can you imagine if we had to store the nxn matrix???  We do that for the local hosts and it's a large chunk of the per host storage.
 
If you want to do forensics, there are tool$$$s that store a days or weeks traffic and let you dig into it.  But even then you need to know you want to monitor - I've never met or heard of anyone who could afford to archive the Gbs of data that flows over a network just in case...
 
-----Burton
 
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Erik Spigle
Sent: Wednesday, January 28, 2004 12:01 PM
To: [EMAIL PROTECTED]
Subject: RE: [Ntop] Possible to produce reports on host Internet history?

Just to follow through with this.  So as it is, NTOP has no way to dynamically 'tag' a host on the fly for further scrutiy -- ie: to monitor.  The only way this can be done is to manually start another NTOP process with said flags pointing at the host that needs to be monitored?  Seems rather... cumbersome.  I'm sure it works fine, but having to visit the NTOP machine each time to start up a process to follow a hosts activity seems a bit involved... but if that's it--that's it.
 
On that note, if this is what has to be done, rrd graphs is metioned, which I know not how to use at all.  Where can I get more details on how to use rrd graphs?  I would also not mind getting more information on the LastSeen plugin, which I have enabled but cannot seem to make work / make sense of.  If this isn't relevant to this thread, I'll ask about that eslewhere.
 
Thanks
 
Erik Spigle
-----Original Message-----
From: Burton M. Strauss III [mailto:[EMAIL PROTECTED]
Sent: Wednesday, January 28, 2004 10:51 AM
To: [EMAIL PROTECTED]
Subject: RE: [Ntop] Possible to produce reports on host Internet history?

-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Erik Spigle
Sent: Wednesday, January 28, 2004 8:17 AM
To: [EMAIL PROTECTED]
Subject: RE: [Ntop] Possible to produce reports on host Internet history?

Jesse:
 
I emailed Luca regarding this, but never received a response.  I may attempt to do this again.  So to answer your question, no, I never did get an answer.  If I do get a response back that I can relay to you, I will doso.  Likewise, please let me know if you find out anything yourself.
 
Thanks!
 
Erik Spigle
-----Original Message-----
From: Jesse Hurford [mailto:[EMAIL PROTECTED]
Sent: Tuesday, January 27, 2004 8:42 PM
To: [EMAIL PROTECTED]
Subject: [Ntop] Possible to produce reports on host Internet history?

Hi,

This is my first post to the list so i apologise in advance if this is the wrong place to ask.

I've found a message that is asking this same question, the message was ---->

  .. From: Erik Spigle
  .. Subject: [Ntop] Possible to produce reports on host Internet history?
  .. Date: Tue, 06 Jan 2004 14:38:16 -0800

In the post Luca replied asking Eric to email him in regards to this, I was wondering if the answer could be posted to the list or emailed to me if at all possible.
Basicaly what i need to know is how can i produce a report showing internet browsing usage by users on our network.

Thanks,

Jesse Hurford

Reply via email to