Internet Monitoring and Networking Infrastructure

[sleepyhead]

So today, I found out I been crapped on again for "internet abuse" while at work.

The IT Manager is only recording hits to websites (in the case of HEXUS it's at least 3 each time I refresh the page) and even then it only logs the last 1000 hits and the log is cleared after 48 hours of non-recording. Also the log cannot filter between break time and work time. The 7 page report I was shown, 3 pages were filled in a short space of time by me browsing Hexus and the BBC news site during my lunch break. To me, this is a flawed way of monitoring internet useage.

So I put it to you super smart people at HEXUS, how would you monitor internet useage? Is web hits a good idea or bad idea or should it really be based on bandwidth useage per webhit?

Following on from the above point, the IT Manager "claims" the internet abuse is slowing down internal company networking ability. Now in my head, I can't see how one affects the other, ie how browsing HEXUS forums will slow down everyone's access to the main shared company server.

Anyone care to shed some light on this?

The point of this post - I'd like to gain some knowledge and understand why we have all these fancy switches and racks only to be told browsing HEXUS (during my alloted break) slows down the entire company network.

[peterb]

What is your company policy on internet access?

[b0redom]

Buy a 3G dongle. Set up static routing for intranet stuff via your LAN connection and your default route via the 3G dongle.

* I am not a lawyer, and if your company's Internet at work policy says you're not supposed to be using it, and you get fired - don't come crying to me....

[Jay]

if you are allowed to browse during your break time then ask them to show you times when you where online.

[sleepyhead]

In theory, the company policy is that we can use the internet for work (which does happen amazingly enough) but during break periods we can use it for more personal stuff as long as it's nothing to do with the three Ps (porn, piracy and phishing).

Anyhow, my query was basically to ask how you would manage the network infrastructure and monitoring of the internet useage. I think our IT Manager is just doing stuff to look like he is doing his job.

[Jay]

for free I would you squid to keep an eye on websites visited / times etc if I had the cash ISA server

[LuckyNV]

If they allow recreational use during break times then they will need to prove exactly when you were visiting non-work related sites before they hand out official disciplinary actions, or at least have an accurate record to show if requested. You would also need to prove it was during your break time, hopefully its official breaks and not "hey I'm taking a break now", that isn't really on record.

[sleepyhead]

Perhaps my original post wasn't clear enough.
I'm not looking for advice on defending my corner, my boss is doing that as he has the logs with time stamps.

What I was after was on how HEXUS people would montior/enforce internet useage and how it does or doesn't affect internal network traffic.

I honestly cannot see how using the internet can cause drastic slowdowns on our internal network as well as slowdown the SQL server based database system we use.

[handscombmp]

It wouln't cuase a drastic slow down but say in your area you've got 5 pc's all using one gbps ethernet cable going to the server you still using a bit of the avalible bandwidth.

I know it only an example but thats it basiclly.
Although you'd have to be doing something pretty big to make a noticebly difference.

[sleepyhead]

Hrm..I ran speedtest after work once and it seems we have a 1Mbit up/ 1 Mbit down service or the QoS is only giving me a maximum of that.

We seem to have a lot of Gbit switches but there aren't that many PCs that have internet accounts.

[Jay]

this all depends on how the network is setup really. If you use a VPN to a DC / terminal services server in a datacenter / remote site and you don't have a dedicated line for the VPN then, yes, it would cause issues if you where on the net all the time (they would not be the main issues with this mind you!)

If it’s a basic LAN and none of your services are web based then it won't cause any slow down at all.

Like I said above, Squid Proxy if I had £0 and ISA if I had ££££££

I have a feeling you may have ISA... "

but there aren't that many PCs that have internet accounts.

How I would set it up depended on what I wanted to monitor, but the best way to monitor internet usage is also the simplest one, a list of websites per user and what time the site was hit. If he wants to look into bandwidth per port this can also be done but won't really tell him much unless he has P2P issues. SNMP on managed switches can be a good guide to who is using the most bandwidth but this only works if the users don't need to pull huge files around the network

eg

If users just log on and use basic mapped drives / redirected desktops then heavy internet use will show up on the graph. If the users need to move huge gigabyte files around internet usage will be so little in comparison it would be hard to work out who is hammering the internet.

Hrm..I ran speedtest after work once and it seems we have a 1Mbit up/ 1 Mbit down service or the QoS is only giving me a maximum of that.

There is a chance you do have a 1Mb/1Mb leased line (before people go on about I get 24Mb / 1.3Mb at home, a leased line has a 4 hour SLA)

If this is the case there is also a chance you may have some remote services that, by using the net, will effect the overall performance of those services. They should get a second business line in place.

[Viper81]

On the bandwidth side, as Jay already mentioned, I'd be looking at SNMP stats from port counters on switches using Cacti (http://www.cacti.net) to pull them into lovely graphs. That will give you a good historical view as well.
For more real-time info it would be Netflow/Sflow pulled from the border router using something like InMon sflowTrend (http://www.inmon.com/products/sFlowTrend.php) to show who the top talkers were.
The methods mention in the OP are, in my opinion, awful ways of determining how long any user spends online. These days most sites contain so many linked images that loading up a single page will generate dozens of dns lookups or proxy log entries.
Even if a user's log only shows one hit on a website that doesn't mean they didn't spend half an hour reading that page. I haven't yet seen a system that can provide any accurate data on "how long someone spends online" (surely it's reflected in how well you do your job and hence is something that you line manager is doing? )

[Moby-Dick]

We used to use Surfcontrol to filtering and Monitoring.

[sleepyhead]

...I haven't yet seen a system that can provide any accurate data on "how long someone spends online" (surely it's reflected in how well you do your job and hence is something that you line manager is doing? )

Oddly enough we are meeting over 90% of our KPIs (as a department on the whole) and individual performance, I can only let my manager tell you that although I would assume I am doing at least an adequate job as he has yet to talk to me about my work (or lack of and reasons for).

Anyhow, this is digressing from the original post/query I posted. Thanks for the posts regarding the queries however it is on a technical scale above my current knowledge base and it'll require some reading (googling) to understand the acronyms and systems.