Spector CNE - network monitoring....

[vi edit]

My company has had a lot of "personal use" abuse by employees and is looking to start monitoring this stuff. Originally they just wanted to log web site access via a proxy, but the scope changed and now IM programs and if possible, .exe use should be logged.

In my searches I came across Spector Soft and their CNE product. This thing looks to be the be all, end all of big brother monitoring. It does email tracking, IM tracking, web useage, tracks what executables are in use, and takes screenshots of the activitiy.

Seems like one hell of a program.

Assuming the powers that be want to go down that road, has anyone had experience with this product...on both the admin and user side of things?

Is it reliable? Is it hard to get around? Do you find that management micromanages and looks to the program too much for monitoring?

It's my first foray into the realm of network monitoring.

 

[pilot006]

Don't you love it? Without the Internet they say they can't get their work down. But once they have it... none of their work gets done!

Anyways, my company ran a pilot of CNE for two weeks in our programming division. We found it much more lackluster that one would expect. Essentially the system requires a client to be loaded onto a monitored terminal. Installation was straight forward... though of the 20 clients we tested... only half ran to our standards. We installed it on everything from Windows 95 to Windows XP. XP loved it... but 2000 and below were not happy. Our 95 and 98 systems blue-screened until we unloaded the client. Big uh-oh for them. Running our network probe on their segment we were startled to find it was transmitting data almost every 5 minutes to the collection server. May not sound like a lot but all those mass e-mails that sometimes get sent are then replicated and sent to the collection server.

On the clients that did have it loaded... we let the system collect data. Some made us laugh, and some made us angry. But the truth is that it provides an almost ridiculously large amount of data. The sort options were there, but still left us wading through user's 400 e-mail messages to see if they had sent info on upcoming projects. You would almost need to hire another employee just to filter through all the data. Though I won't lie... reading some chat room excerpts was awfully amusing.

In the end we chose otherwise. We went with Websense. The server acts as an url proxy to our PIX firewall. We filter out 98% of the bad web content, restrict web radio, and block a variety of protocols (AIM, Gnutella, Remote Desktop, etc...). It's worked efficiently and has been transparent to the end user, until they find out that their favorite XXX site is now blocked. Very little administration is required... and what little there is goes to that one old IT guy every company has where all he knows is the mainframe system and how to annoy everyone else.

If you want anything else let me know. Hope this helped.

 

[vi edit]

Excellent post. Thank you!

This would be about 50 users overall, so the overhead isn't as big as what you guys had. Machines would be a mix of XP & Win2k. It is a bit disturbing that 2k was giving you problems. We've still got quite a few of those boxes laying around that really aren't in the schedule to be upgraded any time soon.

I'll check into Websense. Webmarshall was a stand alone proxy product that I have been evaluating as well. It sounds like Websense is a similar product to that.