In larger networks the problem of figuring out how the system broke or what went wrong can be extremely difficult. And when you are trying to reconstruct something as complex as a virtual breaking and entering any help you can muster could, at the very least, save your sanity.
A product that looks very promising in this area is Iris, a network traffic analyzer (www.eeye.com/html/Products/Iris/) from eEye Digital Security.
Otherwise known as a sniffer, Iris is a data and network traffic analyzer that collects, stores, organizes and reports on all or selected data traffic on your network. Iris must be installed high in the network infrastructure in a hub with a managed port, preferably after a main switch or close to the main gateway.
Iris has received very positive reviews and there are a number of features of particular interest to the Web applications world. Iris can reconstruct Web browsing sessions on an organization's local network and even simulate cookies for entry into password protected Web sites (as long as SSL isn't used).
According to eEye, Iris monitors nonencrypted Web-based e-mail traffic and instant messages which can "complement normal company-based e-mail control, audit and monitoring procedures. " It also captures "the evidence of network intrusions, reconstructing every keystroke and movement an attacker has made, creating a complete log of any attempt to bring harm to your network. "
Iris runs on:
* Windows 95 and 98.
* Windows NT.
* Windows 2000.
* Windows XP with Internet Explorer 4.01 or higher.
The recommended platform is a Pentium 400 with 128M byte RAM and a free 10G byte of hard disk drive.
The product costs $995 per installation and the price includes the first year of maintenance (free upgrades and free technical support).
RELATED LINKS
Network World, 03/11/02
Mark Gibbs is a consultant, author, journalist, and columnist. He writes the weekly Backspin and Gearhead columns in Network World.
Mark Gibbs is a consultant, author, journalist, and columnist. He writes the weekly Backspin and Gearhead columns in Network World. Gibbs is also co-conspirator of the Vitally Important Information Web site.
Gibbs can be contacted at webapps@gibbs.com. Press releases to pr@gibbs.com.
