Port redirection

Dec 09 03 8:42 am

Can you tell me how to stop users from getting around wingates audit of bytes against their account by using port redirection.

Dec 09 03 1:21 pm

So what are your users doing? Some sort of port redirection to avoid accounting?

We will need a few more specific details about what these users are doing.

Adrien

Dec 09 03 1:43 pm

They are using a program called fpipe from http://www.foundstone.com
with the following switches -l 80 -R 80 -i "then their ip address seems to work with any ip sometimes. First tho they log onto wingate, then after they have run the program their bytes received does not increase.

Dec 09 03 2:19 pm

Do they run fpipe on Wingate machine?

Dec 09 03 2:43 pm

No they run it on the client machine. Java logon, ENS, they logon then run the fpipe and their usage does not change.

Dec 09 03 3:17 pm

Erm... I still don't get it - they still run it on the local machine so any connection made form local machine will be accounted for - what are the port settings for ENS?

Dec 10 03 8:13 am

I have tested the program now and it seems that maybe it is not fpipe that is causing the problem as in the accounting tab on wingate none of the fields increase as the user browsers. Is there anything I can do to fix this?

Dec 10 03 10:09 am

Which version of WinGate are you using? There was an issue a while ago (~5.0) where accounting had a few glitches but it should have been fine recently. Doe sit make any difference how the user connects as to whether they're accounted for or not?! What if you create a brand new user, and log in as them?! Does accounting then work correctly?!

Regards

Neil

Dec 10 03 10:23 am

one other thing.

If all surfing is done through one piped connection, it will only be when this one connection is terminated that traffic is added to the user's account. If this connection stays open all the time, then the data count will be building up, but not applied to the user's account yet.

You may just have to block the port or host that they are connecting to with this pipe utility.

Adrien

Dec 10 03 10:46 am

Yes I was running the 2.0 and have now upgraded and all is well again.
Thanks for the quick response and have a great break over christmas.