By Garrett Michael Hayes
Network World, 5/25/98

The explosion of Internet access from intranets presents organizations with the same issues they had when telephones appeared on every desk. Much as managers once had to set policies to regulate employees' long-distance and personal calls, today's IT administrators often need to monitor and control unproductive Web surfing.

We looked at three tools designed to monitor internal network traffic for patterns of use and abuse. While they provided similar functionality, Kansmen Corp.'s LittleBrother proved the best, especially in terms of ready and useful analysis. Elron Software, Inc.'s Internet Manager provided good flexibility, while SurfControl's SurfControl Scout was a trifle weak in clarity of presentation.

Monitoring

The only negatives emerged when we found that the dynamic analysis only covered the preceding hour and that this was the only aspect of the default display we couldn't configure. Elron's Internet Manager captures a lot of useful, detailed information, but its sorting and presentation of Web sites and page components is a bit clumsy.

Also on the downside, you must manually refresh the display, meaning you don't get a picture of current activity unless you specifically ask for it. A separate monitor application provided a real-time view of the most recent accesses, though in too cryptic a fashion for our tastes.

SurfControl Scout provides what at first seems to be the most detailed monitoring and recording, with features that let you quickly drill down to look at access patterns, even for individual elements of Web pages being visited.

Unfortunately, SurfControl Scout monitors and records so many details, including outside workstations visiting the Web pages, that it was difficult to keep track of what was being generated internally. We could put all local stations into a group, but couldn't find a way to filter the on-screen display to just show that group.

As it is for Internet Manager, displayed information with SurfContol Scout is static until you execute a manual refresh.

Administration

For example, Internet Manager and LittleBrother let you categorize workstations into multiple groups; SurfControl Scout lets you assign a workstation to only one group. Multiple groups are useful when you want to classify a workstation as being in the accounting department and as belonging to a director, for example.

Internet Manager had two considerable negatives in administration, however. First, the setup screen from which you define Web administration is ignored - our administrative functions appeared on Port 80 despite our setting them to a different port number. Second, there is a "reboot server" function that really means it. We expected it to reboot the Internet Manager administration services, but it rebooted the system with no warning or confirmation.

Reporting

Internet Manager has a wider variety of canned reports than either of its competitors. It also lets you schedule the creation of customized reports and e-mail results to designated recipients. You can set up the software to run a periodic analysis of traffic for a certain department and automatically e-mail the results to the department head. Unfortunately, these reports, which are tailored for a print medium, are the basis of Internet Manager's on-screen interactive reporting. The reports don't fare quite as well as online tools, simply because they're not optimized for screen reading.

SurfControl Scout produces highly graphical print reports, with fairly good, succinct content. When displayed online, however, some of the reports run off of the screen to unscrollable locations. You can't see elements such as the keys to interpreting the graphs from these locations. In contrast to the others, LittleBrother's reports seem intended more for on-screen viewing than printing. Most reports consist of either bar or line charts with only as much text as necessary to convey their message. You can click on a bar or line to get details about that item. For example, clicking on a user name in a report on activity by site brings up information on that user's activity.

However, it was here that we noted one big problem with LittleBrother's reporting. We looked at a filtered report, such as one for a particular time period, and then drilled down into it for further detail. The filtering remained in effect for the detail report, but nothing in it indicated the filtering criteria. In one case, we ended up with two reports showing different sets of activity by the same user, with no way to tell why they were different.

More important than the information in the report, however, is the interpretation placed on it. All three products seek to break activity down into meaningful categories such as productive vs. unproductive, or business vs. nonbusiness. Each approaches this problem in different fashion.

LittleBrother uses a database, which Kansmen updates twice monthly, of known sites with preconfigured group assignments - for example, computer, sports or hacking. The product clearly flags visits to sites such as those run by toy companies, sports networks and adult content providers. You can add new sites to the database, change the group to which a site is assigned, add new groups or change a group's rating - productive, neutral, unproductive.

The system isn't foolproof, however, and some of the failures were striking.

We visited a site whose name we made up because it sounded pornographic. The site, which actually existed, turned out to be shockingly obscene. Yet LittleBrother rated that site visit as productive, surprising us almost as much as the pornography on the site itself had.

In Internet Manager, Elron uses "dictionaries'' to define characteristics of traffic in order to determine the nature of the activity.

For example, a dictionary might indicate that any file downloaded that has an AVI or MOV extension is a "movie." Another dictionary might indicate that site names containing certain key words are "suspect."

Internet Manager's reports categorize activity in terms of dictionary definitions. This lets you create a report with a list of all suspect activities or all movies downloaded by a given user, for example. The vendor provides several dictionaries; you can add more.

In contrast to the other products, SurfControl Manager puts the entire classification burden on the administrator. It requires you to go through the list of sites gathered by the system and assign each to a category, such as business, nonbusiness or none.

SurfControl assured us that customers don't find this seemingly daunting task too difficult and that the list of sites stabilizes quickly. Observing even our small network made the company's claim seem dubious.

One thing with which none of the packages dealt well was the issue of mixed sites.

Individuals and commercial sites may be hosted at the same ISP. Thus Joe's really useful page on NT widgets may be viewed as coming from the same source as Judy's dating service or Janet's Whips and Leather Emporium. None of these products is able to distinguish sites at this level of resolution.

Installation and documentation

While none of the packages had documentation sets belonging in the hall of fame, LittleBrother's was best, with Internet Manager running a close second. SurfControl has no printed documentation. Instead, the company puts its documentation online in HTML format. Because it's not searchable in this form, its usefulness is limited.

The bottom line

Elron's Internet Manager has a richer set of reporting tools and automated functions, but configuration and management are not as simple. SurfControl's Scout is highly detail- oriented but not sufficiently analytical to be our tool of choice.