Tracking down excessive download problem...

[sunil5]

Hi all,

Having recently visited a site at work- I've found that the ADSL 2Mbps link is very slow. I have ran speed checks at regular intervals during serveral days and the average connection is about 100 Kbps (with everything working 'correctly' I have always seen speeds above 1600 Kbps).

Phoned up BT to do a line check and it turns out that a massive 350GB of data has been downloaded in a space of 34 days. This is obviously a internal network problem- my question is what would be the best tools to use to track down what computer(s) this data is being downloaded from.

N.B. There is a Mimesweeper for Web filter installed which blocks most things such as streaming media, downloading files, etc. Unfortunately the 'reporting' service has not been installed since it needs a separate server.

Any help/advice would be much appreciated.

Sunil

 

[vipergg]

how is your DSL connected to the network ? If there are manageable switches behind it you should be able to clear the traffic counters and see who is the big hitters after a few days . Not knowing your network setup itws hard to recomend much else .

 

[bcastner]

. Do you have each user sign a comprehensive statement of acceptable use at your site?

. Issue a statement that the user of peer-2-peer software such as Bit Torrent, eMule, Kazaa, Piolet, etc. is not accceptable. Ask each user to sign an acceptable use statement. Explain that a violation is sufficient cause for termination of employment.

. Explain the issue: that the use of peer-to-peer software has crippled the site, and attracted the notice of your ISP.

. End by stating that you have installed monitoring software, and the user agreement will be excerised as to termination without discussion.

Everyone in that office knows the individual(s) responsible. Annually ask all to sign a user agreement on responsible use, and let self-enforcing take the place of what could be expensive software or hardware approaches to the issue.

 

[sunil5]

Thanks both for replying...

bcastner- One important thing I forgot to mention is that 20 of the total 40 computers are used as a public internet cafe. The rest are used by office staff who have been asked to sign a similar type of statement that you mention above.

I've only been at this site for about 1 week and could not see any obvious signs of people using p-2-p - I have also tried installing some of these programs and all them so far have been blocked either by restriction of downloading/installing the program or running it.


vipergg- The DSL is connected to a Cisco PIX firewall and then to a few Cisco Switches (not sure of the models). But I don't have any control of these. Just have full control of the Win 2000 Server.

 

[vipergg]

Your going have a problem then if it's just part of a wide open internet cafe , it could be anyone showing up once in awhile and downloading these big files .

 

[bcastner]

Wireless?

I could be a neighbor.

I find it hard that customer (or all customers) would reach 350Gb downloads in a month.

 

[bcastner]

Consider running this freeware P2P killer on your Cafe machines:

http://www.palmersoft.co.uk/

(Note: it does not block Bit Torrent clients at the moment).

 

[sunil5]

Bcastner,

We don't have any wireless points anywhere in the building. I thought exactly the same about customers being able to download 350GB of data in such a small amount of time.

I will have a look at that software too.

Thanks for replying.

Sunil

 

[bcastner]

Run a network scanner. There are terrific freeware options:

http://www.insecure.org/nmap/index.html

http://www.angryziber.com/ipscan/

And my current favorite:

http://www.lookatlan.com/lookatlan.html

(this is a great freeware product).