How to tell what clients are connecting?

[Chambers]

Hi Guys,
I've got a major problem here. The opther day I noticed that our t1 connection suddenly came to a crawl. I checked out my firewall logs (netscreen) and noticed there was a lot of traffic coming from some porno sites. So I'm guessing one of our clients is accessing som inappropriate material. Now I went into our ISA logs hoping to find the culprit. I looked and found the destination ip[, however the logs only say that the ISA server ip was the originating ip with the request. Where can I look in ISA to find the client that connected to isa that asked for the request? Please help as this is killing my network performance, thanks!!

 

[paul123456]

Sounds like you have a configuration problem somewere. are isa server is the gateway also right?

Thanks, PAUL

 

[zcolton]

The correct response is "It's in the logs" but that all depends upon what info is being logged, and if there is some kind of authentication going on. It also depends how your clients are configured (Web Client, Firewall Client, SecureNAT Client) I would recommend you take a real close look at how your server (and workstations are configured.)