|
|
|
|
|
|
Spector Pro records information about every network connection made on the monitored computer, providing you with a complete overview of network usage. It lets you know which web sites are visited and how much data is transferred to and from those sites. Network Activity can only be accessed by selecting Window > Network Activity. There is no designation for it on the Viewer toolbar.
|
|
By default, Spector Pro does NOT capture Network activity. To learn about how to capture this data, and how it affects what you view in this window, see Network Activity Settings. |
Click here to view a screenshot.
After analyzing Network activity data, you may decide to block Internet access to TCP ports or domains, remove applications from computers, or tighten your company Internet use policy. Network activity helps you detect:
The use of streaming audio / video, online gaming, and other potentially inappropriate programs.
Productivity drains by monitoring which users are connecting to the Internet and when the connections are made, the Internet address they connected to, what TCP ports they use, and the amount of network bandwidth consumed by those connections
Which users may be violating company policy by consuming network bandwidth with streaming media, file downloads, or other Internet activity.
Security violations by listing which applications are connecting to the Internet.
Which Internet resources are most often connected to, which may not be reflected in other Spector recording tools.
The Network Activity event window uses a Navigate / Detail and Summary pane design. Information displays in the lower Summary and Detail panes for the event(s) selected in the upper Navigate pane. You may change the order in which columns are arranged or how information is sorted within a column.
Navigate Pane (upper)
Each time a user makes a network connection it is considered one recorded event. Events are arranged in groups and sub groups and sub-sub groups, each of which is displayed like a branch on a tree. By default events are grouped first by date, although you may choose to group the events differently.
Click on the plus (+) sign, which then becomes a minus (-) sign, next to the Network icon to expand the tree and view each date for which activity was recorded.
Click on the plus (+) sign next to a date to expand the tree and view each domain connected to on that date.
Click on the plus (+) sign next to a domain to expand the tree and view each subdomain connected to within that domain.
Summary Pane (lower)
Click the Summary tab to view this pane. The Summary pane displays totals for each recorded event(s) highlighted in the Navigate pane. By navigating up or down in the tree above, you display a wider or narrower view of events.
body
For example:
Select the Network icon at the top of the tree to display totals for all network activity that has been recorded.
Select a particular Date, for example Fri, Aug 25 to display totals for each network connection recorded on that date.
Select a particular Domain, for example aol.com, to display totals for each time a network connection was made to that domain.
Detail Pane (lower)
Click the Details tab to view this pane. The Detail pane displays specific information for each recorded event(s) selected in the Navigate pane. By navigating up or down in the tree above, you can display a wider or narrower view of events.
For example:
Selecting a Date in the upper Navigate pane shows ALL Network Activity records for that date in the Details pane.
The Summary pane displays the following columns:
Program - The name of the program that established the network connection.
Domain - The name of the web site that was visited.
Port - The IP port used for the network connection.
Connections - The total number of connections for the program listed.
Sent - The total number of bytes sent for all connections made to the program listed. You can estimate the amount of bandwidth the connections used.
Recv - The total number of bytes received for all connections made to the program listed.
Duration - The total connection time from the beginning of the first connection to the end of the last connection to the program listed.
Right-click in the column heading area to display additional columns:
Protocol - Only TCP network traffic is captured.
Subdomain - The subdomain (section of a web site) to which the network connection was made.
First - The date and time when the first connection to that address was established, using the format MM/DD/YYYY HH:MM:SS AM/PM.
Last - The date and time when the last connection to that address was established, using the format MM/DD/YYYY HH:MM:SS AM/PM.
Start Time is not always the actual time the network connection started. Network connections for events that begin on one day and continue past midnight into the next day, are broken up into two separate events.
For example, the first start time is when the Network activity begins recording and the end time is at 11:59:59 PM. The second Network activity connection starts at 12:00:00 AM and either ends again at 11:59:59 PM or when the connection ends.
Last - The time, presented as MM/DD/YY HH:MM:SS AM/PM, when the last connection ended for the recorded event.
The Details pane displays the following columns:
Start - The date and time when the first connection to that address was established, using the format MM/DD/YYYY HH:MM:SS AM/PM.
Program - The name of the program that established the network connection.
Subdomain - The subdomain (section of a web site) to which the network connection was made.
IP - The IP address of the site where the connection was made.
Port - The IP port used for the network connection.
Connections - The total number of connections for the program listed.
Sent - The total number of bytes sent for all connections made to the program listed. You can estimate the amount of bandwidth the connections used.
Recv - The total number of bytes received for all connections made to the program listed.
Duration - The total connection time from the beginning of the first connection to the end of the last connection to the program listed.
Right-click in the column heading area to display additional columns:
End - The time when the last connection ended for the recorded event, using the format MM/DD/YYYY HH:MM:SS AM/PM.
Protocol - Only TCP network traffic is captured.
Domain - The name of the web site that was visited.
The Network Activity event window contains the following shortcuts:
Group by - Use this to customize the display of recorded data in the Navigate pane tree. You may select how data is grouped, and the order in which the groups appear in the tree. You can also determine the direction in which information is sorted (ascending or descending).
Jump to - Click to select a specific recorded event in the lower Detail pane and then jump to Snapshots or Keystrokes.
Search Network Activity - Use Search to quickly locate a specific word or phrase. Search works like a filter displaying only the data that matches the search criteria.
Delete - Use Delete to remove one or more events.
The menu bar is specifically customized for Network Activity.
The status bar contains the standard items.
Next: Reviewing Screen Snapshots.
