Advice needed: How to track employee internet usage.

D

DaBump

Well-Known Member
Joined
Apr 10, 2007
Messages
241
Reaction score
0
Location
George, Western Cape
Good morning MyAdsl'ers! I need some advice! We are about 15 people in our office, and everybody connects to a wireless ADSL/router that provides an internet & lan connection. Unshaped office hours bandwidth is quite expensive, and every now and then somebody misuses their rights of having an internet connection at work. I'm looking for a a freeware application / solution to track usage, so that I can determine who the culprit is thats stealing our bandwidth. Any ideas? :confused:

Thanks, DaBump
 
Careful with this...CCMA will be on your a$$ if you use it against them, it's kinda illegal.

There is a program called "K9 Web Protection" that can block various sites, send an email of excessive usage, report on usage etc. And it's free.

Make sure you make them all aware that their usage is being monitored.
 
ben dover said:
Careful with this...CCMA will be on your a$$ if you use it against them, it's kinda illegal.

There is a program called "K9 Web Protection" that can block various sites, send an email of excessive usage, report on usage etc. And it's free.
Click to expand...


Wrong, monitoring staff emails and internet access is allowed. Its not a privacey issue as you are using company time and resources.

I confirmed this during pending disciplinary action against one of my wifes staff. (We even extended it too telephone calls and sms sent from the office modem).


But what he is looking for is a proxy / gateway that keeps logs of everyones bandwidth usuage. Best is to set up a LINUX server. You get many flavours that require near zero config.


ben dover said:
Make sure you make them all aware that their usage is being monitored.
Click to expand...

Agree. This alone will scare them into being more conservative. Also make usuage public, self policing is the best.
 
It's not illegal.

Develop an fair internet usage policy and get them to sign it. The policy can easily say no private internet usage. The labour guys says, don't allow private use, because if you do it is subject to abuse and you can't do anything. Check out www.labourguide.co.za.

If it is abused, you have to go through a disciplinary procedure.
 
What i meant was that if you monitor their usage without their consent or knowledge, it can cause you more headaches than you know....
 
ben dover said:
What i meant was that if you monitor their usage without their consent or knowledge, it can cause you more headaches than you know....
Click to expand...
Only if you let someone bully you into believing that. You dont need anyone's consent or permission to monitor them while they are on your premises.
 
pfsense - free linux firewall proxy thingy
Routes alll internet acces via it, should be able to do everything you want.
 
use a firewall to block access to certain ports, like bit torrents, FTP, SSH, etc (unless they REALLY need it), and also web sites like facebook, myspace, twitter, etc. Limit their email sized (i.e. max 5MB per email), attachments, etc. In fact, if you could, run everything through a central firewall / gateway. For a low cost device, get a Cyberoam 15, which will allow you to see who uses how much bandwidth, which websites they visit, what they download, etc. You could also setup timed policies to allow them to only surf work-related websites, and block everything else.

Then, setup a fair usage policy which they need to sign, and have a clause in that anything non work related could lead to them paying for their bandwidth, written warnings, or dismissal. In case someone takes you to CCMA cause they can't chat to their mom no Facebook, then you have clear company policy which states it is against company rules to facebook :)
 
Use a squid proxy - there's loads of reporting software you can use to generate stats.

Also draw up a usage policy saying they will be monitored, no porn, no p2p etc etc - you will need this if you fire someone. They don't have to sign it but must be aware of it. You can put it in the logon script so by signing onto the domain they accept the T&C"s
 
True squid won't do p2p/ipsec etc (it will see skype - its 443) but if your allowing your employees to do bittorrent then you should be shot. As you said - block all ports unless otherwise needed. Us a proxy so there are no direct connections out either. Use a smtp server as well - direct out out on smtp works wonders for mass mailing viruses.
 
Sure, but the OP has no mention of a current firewall setup, and my assumptions (from the fact that he has asked advice, and has made it clear they use a wireless ADSL router) is that he currently only relies on the build-in firewall that came with the router. This will only block possible attacks from the outside, not from the inside. And I guess he doesn't have any, or much Linux / firewalling experience, so he needs something that will work, and is easy to maintain. A linux firewall (even something like Smoothwall / monowall / redwall / etc) is probably too intimidating for his needs.
 
It also depends on what existing infrastructure you have in the office. Workgroup, Domain, Windows version etc... Smoothwall out the box will do the proxy part easily enough, but it doesn't have a very good reporting system in it, in my experience.
 
Asha'man X said:
It also depends on what existing infrastructure you have in the office. Workgroup, Domain, Windows version etc... Smoothwall out the box will do the proxy part easily enough, but it doesn't have a very good reporting system in it, in my experience.
Click to expand...

Sarg rocks!
 
Hi guys! Thanks for the replies! MyADSL is the place to ask these kinds of questions, and you get lots of intelligent replies! thanks again! Ok, we're a linux shop, running ubuntu on desktops and centos as server environment. I'm not to clued up on network routing though, even though I'm the administrator (and also the owner of the company :) ) I do have a spare machine I can use as a server to setup the proxy / monitoring software. My question is just, if I have a wireless adsl router that does the adsl connection, and through wich the users connect to via WIFI, how would I stop internet connection on the router, route them through the wireless portion of the router to the linux machine, and then back out via the router as adsl, or do I need another pure WIFI router, and the adsl modem as the gateway? Once again thanks for the help!
 
Asha'man X said:
It also depends on what existing infrastructure you have in the office. Workgroup, Domain, Windows version etc... Smoothwall out the box will do the proxy part easily enough, but it doesn't have a very good reporting system in it, in my experience.
Click to expand...

The Advanced Proxy and Calamaris add-ons for smoothwall (and ipcop) provide a pretty good reporting capability.
 
DaBump said:
My question is just, if I have a wireless adsl router that does the adsl connection, and through wich the users connect to via WIFI, how would I stop internet connection on the router, route them through the wireless portion of the router to the linux machine, and then back out via the router as adsl, or do I need another pure WIFI router, and the adsl modem as the gateway? Once again thanks for the help!
Click to expand...

I don't think that will be easy. Better to get a new separate box (either a new wifi access point or a new ADSL modem) and put the linux box between them.
 
Depends on how configurable the routing is on the wifi router. But its going to be a mission - it will be far easier to just get a wireless router and put it on the inside of the network. Or even better you can run it as follows (I've set mine up like this)

put 3 nics in the machines, install IP Cop. Use your ADSL router in bridge mode and connect to 1 nic. Connect the wireless router to the 2nd nic and setup on ipcop as the blue zone (it will be in a dmz then - you can lock it down for security), connect the 3rd nic to a switch which your internal machines plug into. Setup squid for transparent mode and off you go.
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X