Printable View
Hello,
I am interested in finding out what, in your opinion, is a good average for holding onto network traffic data, specifically internet data history. This question is posed from a school district network using Windows XP. Just curious because a situation requiring an investigation about websites visited is being proposed and I want to have my ducks in a row before the investigation begins...
thank you in advance...
Well, do you have a Cache Server? I mean, a lot of times, schools are pretty bad at everything. It's pretty funny really, because, they teach people how to become a network admin, yet they don't really use it themselves.
I've seen schools who don't even have a system set up for this type of thing, and it's just pathetic really. If you want some advice, get yourself a machine that can act as a machine that basically saves history, maybe whack something on the top for it for an interface, and try to save everything for 6 months if you can.
If you run into problems with getting funding, and you will, save the Cache of every site the people you have to go in front of have ever gone to, find the porn they usually look at, and just black mail them. It's not ethical, but if you want to be ethical, get away from admin work altogether.
If you for some reason don't find porn with these people who think it's more important to buy new chairs and desks rather than updated books and machines, tell them you could stop "children" from doing this.
Every time a politician wants to get away with doing something illegal, they use the scared Mommy act and "What about our Children?" and then it works. Every time.
But to answer your question, basically, you should keep 6 months or more of what people are looking at online. You'll probably have kids whining about privacy but if they aren't using their own computers and their own net connection they don't have any rights anyway.
I say as long as possible because the way you've worded your message, it seems like something has already happened, and you need a hand in what to do. So basically, the longer you go back and can check stuff, the better.
You'll need a way to do this though. You're only going to get stupid kids with what Windows XP comes with, the smart ones are going to realize that they can erase the history they leave with a few mouse clicks.
I work as a sysadmin for a school district. We use a product called Lightspeed Systems. It logs everything. It also correlates ip addresses, time of the incident, and LDAP username. I believe that by default it keeps all of this information for a year. It also provides reports on suspicious/blocked search engine queries, which is a really nice feature. It is not cheap though.
big brother westin is watching you >.<
heh. What is really funny, is that when I was in high school, I published an anonymous newsletter that detailed several ways to bypass the schools security in different ways, and I had a section in there complaining about how orwellian the school was. I was a definite thorn in our sysadmin's side... and now that is what I do for a living.
security at my highschool was easily bypassed via a proxy or some simple networking. I guess it also helped that one of my good friends was buddy buddy with the system admin, and so for securing their system, we can free access to rampage about the network >.< meh, but that was high school. My college network isn't much more secure though, but that is what you get when you move to a more rural landscape >.<
Yeah, there weren't many proxy servers when I was in HS. Though you could use a batch file to get to a command prompt, then ping the ip, and use the ip address to get to the site. The content filter was only blocking by domain names.
Another funny thing that they did was map a network drive over the floppy drive. So if you wanted access to the floppy, you just had to unmap the network drive.
why didn't you just do nslookup instead of ping? hahaha at the mapping. Man the funniest thing I can remember from being in HS was the system admin keeping netbios enbabled so we just used nbtstat to log into each others computers so we could try to frame/embarrass one another. (to show you how geeky I am, I actually know the damn history of the word embarrass >.<) The network admin eventually caught on though :'(
nslookup would have worked just as well, but I wasn't as familiar with command line then as I am now... ping was a quick and dirty way to convert hostname to ip. It is funny how many ways I figured out how to bypass restrictions that would have, in hindsight, kept me out of a lot of trouble. I think I was kicked off the network more than I was allowed on. More often than not, I would have to have a teacher log me on... though, very early on, I found an access database that contained all of the teachers' usernames and passwords, so I could use that if no one was looking. My senior year, I got caught logging into the school's FTP server with elevated credentials, and that pretty well ended my ability to log on to any computer legitimately. My computer maintenance/networking instructor still gives me crap to this day about that one. She about fell out of her chair when she found out I was a sysadmin at a school district just a few miles away.
I always figured embarrass had something to do with 'bare *ss'... lol
Amateurs... I used to add videos to the "Windows Start Up" folders. The teachers had the login "Multimedia" and students logged in with the login like "CIS220" for CIS class 220, and so on, so if you were in room 201 it was "CIS201" and so on.
So whenever the teacher would come look from complaints on why there was a bunch of porn that loaded when a student logged in, it wouldn't show up when a teacher or admin logged in. Took them a while to figure out.
That was after my high school days. I got sent to one of those adult ed centers because I got kicked out of school for my grades of all things. Who knew insulting teachers was a soft spot...
At the Adult Learning Center... The admin was whoever they could get, and they used this crap application for tests which ran on an OLD Mac... This school still had 5 inch floppies in un-opened boxes.... So, basically, it was open season as far as I was concerned.
I found a way to crash the app so that it would basically load a small window where you could enter values, and so I'd crash the app, and give myself an A, so when the teacher would ask how I got done in 30 seconds, she'd see I'd gotten every question right, and have to write it down and give me an A because policy was whatever that screen showed they had to give...
I'd take a screen shot of a desktop, and make it the background and get rid of all the icons, install an app that flipped the screen upside down and name it Internet Explorer so I'd sit there while someone behind me would have their screen look like it was flipping out cause "Well it didn't work the first time I'll keep trying"....
Then I'd sneak up behind the row of desks and unplug keyboards, mice, network, whatever it was, and watch the teacher laugh (They saw me do it and thought it was funny) and sometimes I'd get bored, well, a lot of times I'd get bored, and make the home pages my friend's site that would crash Windows, or I'd open the Network Manager thingy they had installed, which rarely asked for passwords, and shut down net access to a high school a few miles away because my Cousin went to school there and I knew he used his day to download MP3s, so I'd shut them down.
After the first few Semesters, they actually had a policy that I wasn't allowed in the Computer Lab while the tech was there. Every time he'd show up to fix the machines and stuff, I had to leave the room and sit outside. They literally made me do that. It was stupid.
They started blocking ALL IRC so no one could chat at school, so I made one with Java and HTML that ran off a floppy disk, and they were starting to watch traffic, so when you'd type a website like sex.com or some crap they'd see it, and so I'd start doing stuff like going to "www.ImOnIRCNow.Com/YouCantStopMe/YourDumb/hahahahahaha.html" or something, and the teacher would get a ping sound on his desktop and get up and look at my screen and get all mad.
He would walk up behind me and see me on IRC and be like WTF! That's Blocked! Then he'd check the history and see nothing because it was running off a floppy and get more mad. He snapped one day apparently when I wasn't there, and like flipped out and quit. He started screaming he didn't make enough to "Put up with these little bastards" lol.
I got good at one point at doing stuff with cables while standing there talking to a teacher, and would unplug their machines so the net wouldn't work, and while they were trying to fix that make their machine shut off all net access.
One teacher like hated me, and one day she asked me "So when are you going to do something useful for once in your life?" Which pissed me off, so when she went to the bathroom I unscrewed the bottom of her chair, and when she came back and sat down, BOOM. She got up and looked around and saw me playing catch with the screws and got mad at me. I was like WTF you insulted the crap out of me so I did something useful....How's the leg? lol.
She did the same basic thing again one day so I super Glued her windshield Wipers down to the glass so they wouldn't work. I didn't know how well I timed it because it started raining a half hour later lol.
That was the day I had super glued all the chairs in one area of the class to the carpet they had in there. OMG it was funny! They walked in and all of the tables and chairs in that room in one corner, were super glued down, lol.
Oddly enough I'd never read BOFH before this, so I guess I just had it in me.
Probably not as bad as putting match stick head powder in a floppy disk and writing "Exam Answers" on the sticker you could put on floppies... That stuff actually does star a small fire inside the floppy drive!
gore - I always feel like I am reading a small novel whenever you post. :D
I tried to shy away from the malicious... I think the worst thing I did was set autoexec.bat to loop... which the network admin wasn't smart enough to figure out, so he reloaded the os...
I also found a directory on a server that had a bunch of files showing up.. it seems like they had a .101 extension, but I can't remember for sure... It turns out they were emails going through the server... I still to this day do not know what kind of system it was, or why I was able to access it, but I was able to capture a large amount of email... Even found out about an impending divorce between one of the tech's and her husband.
One of my other favorite tricks was to switch the keyboard cables with the computer next to me... or just between two random systems. That is a good way to get usernames and passwords...
I also set a bunch of systems to have a homepage that I created with a username and password box. People would undoubtedly type their domain credentials into them. Those credentials would then be emailed to me... :)
Quote:
Originally Posted by westin
Contradict much? Lol!Quote:
I also set a bunch of systems to have a homepage that I created with a username and password box. People would undoubtedly type their domain credentials into them. Those credentials would then be emailed to me... :)
I actually forgot to mention how one time I was screwing with the PA systems at that school and with a friend, got Black Sabbath to be played through the PA System through the entire Building. That was awesome!
Then again, the Start Up Sounds for Windows at that school were mostly either Cannibal Corpse, NIN, or Deftones by then anyway lol.
And that little comment about a Novel wasn't funny ! That took a lot of typing for me to share something so personal! LOL! My poor feelings you big meanie head!
And to think, I let you use BOFH in your custom title! Kidding of course. Realized a few minutes ago no one has yet invented a way to tell the tone used in a text only post lol.
Westin, Write me an app that can tell the tone of a post by the end of today or your custom title becomes "PFY" Lol.
Anyway, I'm kidding again, but you have to admit, when I super glued half the tables and chairs down in that class room that was DAMN funny lol.
I'm not sure if you remember all those BOFH / BAFM (Bastard Admin From Michigan) stories I wrote, but a lot of what happened in those, was based on real stuff I'd been doing lol. I remember when MsMittens on here realized that... There was a new clipping she found about "Hacker in Michigan hacks into fast food head sets and tells customer they were too fat for a Whopper" and she was like isn't gore from Michigan? Lol. Then someone else pointed out that like a little before that, I'd put in one of my Bastard stories how I'd done that. Good times :)
Hows THAT for a Novel lol.
:) You know I love you gore, we misfits fans have to stick together... heh.
I don't think that stealing credentials was as malicious as superglueing windshield wipers... :)
Don't get me wrong, I find your novels very interesting... and I still use your music as background for my halloween parties...
The BOFH title is warranted... I still threaten [l]users with deleting their files when they tick me off... whether it be purchasing unauthorized hardware, or taking my parking spot... :D
I have only connected mains wiring to a few keyboards... but hey... workman's comp, as it were... kaaazeeerrrrt!
by the way... where is your original halloween theme? I don't see it on your site?
LOL! Good!
My best friend and I used to call certain numbers which would get pay phones Disconnected, and then go back the next day and take the signs they'd put up. I used to hang them up in my bedroom back in the day. It would say something about The Pay phone being Disconnected and something else, and they were neat, so I used to put them on my bedroom door. They were awesome and made neat Decor lol.
Man using me as BG music for Halloween, lol that first year I was doing it, most of that music was just not very good lol. I'd listen to it like "Well, I guess considering I've been using this app for a week it's OK but wow.." I didn't even know how to make different pitches when I first started uploading those songs. It took me like a month to get the hang of everything, and even then I still didn't know how to use Samples with LMMS itself, so whenever I'd add those Horror Movie Samples, I'd use a WAV editor, and shove them in with that, but it would pause the music while it played and I hated that. Finally I realized LMMS can handle WAV files, so I started using it for that too so I could play a sample from a movie while the music was playing, which is why the stuff up on my Myspace now sounds a LOT more professional than the stuff from back then lol.
I should put up some of the videos I have of my Cousin and I playing on Halloween. We used to play every year. I had super long hair so I'd do a Devil Lock, and he played Guitar, so he'd do that and I'd play Bass, and record it and make videos of it. There's one you can tell we're pretty hammered and I'm sitting there (To drunk to stand up) playing "Saturday Night" with my Cousin, and for some reason we thought it was a good idea to try and sing that song while playing it. I mean, don't get me wrong, we were doing a great job, and it was how you play that song, but WOW were we bad at singing it. Even worse, we're laughing our asses off while singing because we could tell even drunk that we sounded like crap.
I still have that video lol. And the one of me in full Skeleton Glove gear playing some Misfits stuff....And another of me which is pure audio playing We Are 138 non Guitar and Bass both. I even did the Solo lol.
The last recording from that night is my Cousin pointing out the cops are getting called on us and me going "Ah **** the cops" right before stopping the recording and getting out of there.
Not that long ago I started looking through old back ups I had, and found CDs I made like almost 10 years ago. It's really crappy techno and guitar.... I don't have any of it uploaded, and it's all WAV files lol. Man they sound bad. I mean it's cool considering what I was using to do it, but WOW it sounds bad in the quality department.
man, my ass is too drunk to keep up with yall >.< and believe me typing the accurately is hard >.< ****, the craziest time in high school for me was when the teacher was getting mad at me every day for "not working" during cs class, where I had **** done the day it was assigned, so I eventually snapped and locked her out of the network using the fact that all users had access to certain services which then lead to catapulting to admin privs. I met the principle for the first time in my life and my parents took away my computer for 2 months :( So I guess I am the biggest loser T_T
I took it down to make room basically. They only allow like a certain number of songs up there, so I had to take it off so I could get newer ones up. I'm probably going to change what I have up there anyway since I haven't in a while. Well, other than uploading newer ones.Quote:
Originally Posted by westin
I don't like the idea of kids viewing what they want on public terminals simply because of hygiene. Dirt on your hands is one thing... but sexual fluids are another.Quote:
Originally Posted by westin
To get back to the original post, the common value over here would be a year (rolling 12 months).
If you have good analytical tools and manage by exception you can probably weed out a fair bit of irrelevant stuff though.
There is a reason it's called "The great un-washed" ;)Quote:
Originally Posted by The-Spec