Wireless breadcrumbs
Q: How can we determine if any of our employees are visiting inappropriate websites at the office using company-supplied computers and internet access?
A: The process of browsing the internet leaves telltale breadcrumbs on your wired or wireless routers, enabling you to monitor web activity by user. Almost all routers possess the ability to capture each user’s unique IP address along with the date, time, and URL for each webpage the user visits. As an example, following are steps for logging in and configuring the NetGear Wireless-N router to capture and send you log files. Note: These steps will vary slightly depending on the brand of router you use.
1. Log in to your router. (The specific instructions for logging in to your router’s menu, including username and password, are usually printed on the bottom or back of your router.) Launch a browser and log in to the router. (In my case, I enter the web address routerlogin.net, and enter my username and password.) This process displays my router’s administrative menu, pictured below:
Note: Some CPAs find the process of using a browser to log in to their router confusing because it appears that your router’s settings are maintained on the internet. This is not the case; despite the use of a browser to access your router’s menu, that menu is maintained on the router itself, not the internet.
2. Enable monitoring. To capture user activity logs and have them emailed to you at regular intervals, select E-mail from the router menu, and check the box next to Turn E-mail Notification On. Enter the necessary outgoing mail server, email address, and authentication information in the Send Alerts and Logs Via E-mail section, and then indicate the desired reporting interval in the Send Logs According to this Schedule section. (I selected Hourly in this example.)
3. Set up a blocked site. My NetGear Wireless-N router requires me to block at least one keyword or website before it will start capturing any user activity (your wireless router may or may not require this step). To block a keyword or website, select Block Sites from the menu and enter a phrase or website name into the Type Keyword or Domain Name Here box. (In this example, I have blocked the fictional website violentgames.com.) Once a blocked phrase or website is set up, my router starts capturing (or logging) all users’ internet activity.
4. Review log files. Later, after your router has had time to log user activity, you can review that activity by selecting Logs from the menu, an example of which is pictured atop the next column.
The log reports each user’s IP address along with the webpages visited by date and time. (In this example, the report shows that user 192.168.1.12 visited the webpage media.journalofaccountancy.com on Sept. 12, 2012, at 9:07 a.m.)
5. Identify a user’s IP address. To match an IP address to the respective computer, select Attached Devices from the router menu to display your network’s IP Address and Device Name list, as pictured below. In this example, we find that user 192.168.1.12 is associated with the computer named CARLTON_IBM, which identifies the computer using that specific IP address, and thus the user.
Alternatives:
1. Review your employee’s computer. Usually, you can also track a user’s web activity by examining his or her computer, depending on the browser, email, and computer archive settings. To do this, review the computer’s search history, cookie history, temporary internet files, emails sent and received, junk email folder, and recycle bin for inappropriate activity.
2. Install monitoring software. You might consider installing web monitoring software such as Spector Pro ($99.95) (spectorsoft.com), WebWatcher ($97) (webwatchernow.com), or PC Pandora Pro ($69.95) (pcpandora.com) for more professional control and web monitoring.
