Upcoming Events

Cloud Connect
Santa Clara
Feb 13-16, 2012

Cloud Connect brings together the entire cloud eco-system to better understand the transformation we're experiencing and promises to be the defining event of the cloud computing industry. Learn about the latest cloud technologies and platforms from thought leaders in Cloud Connect’s comprehensive conference.

Register Now!

F E A T U R E

ESniff Noses Out Mischief Makers

June 25, 2001
By Sean Doherty

Pearl Software Pearl Echo 4.0 Global Internet Management

Pearl Software's Pearl Echo 4.0 Global Internet Management, like SurfControl's SuperScout, has server and client code. The client code applies to client PCs, however, not the server machine. Echo's client-server tracking utility beat eSniff 1100 by tracking Internet chat, both IRC and ICQ, but Echo does not monitor telnet activity. Also, Echo lacks the substantive reporting tools supplied by Elron's IM and SuperScout. On the upside, Echo's software installation and configuration is a relatively painless affair, second only to that of eSniff 1100.

Echo's server components (14,500 KB, including the code to be distributed to clients) installed easily on our test server. After we rebooted the server and started the Echo service, dialog boxes led us through server configuration by supplying the IP address of the server and selecting the port for Web services. We determined whether users must authenticate to the NT domain to access the Echo service, and then we set the default browser and text editor. Finally, Echo is the only service that gave us the option to change the administrator password on install. Done. We turned on the Internet Management service and logged in, and a profile wizard whisked us through the rest of the configuration routine. Compared with IM and SuperScout, this was a walk in the park.

Content-Monitor Features

Click here to enlarge

Using the profile wizard, we configured Echo to its default setting, monitoring all activity but allowing full access to all sites. Other options include blocking all access or limiting access to a list of URLs (block and allow lists are synchronized on client PCs). We elected to manage Internet access using a list of custom keywords and to review the content of e-mail, chat and newsgroup activity. Exiting the park, we jumped right into the Echo service.

Echo provides for a silent, automatic installation on client machines running Windows 9x, Windows ME, Windows NT or Windows 2000. The installation configuration file identifies the Echo server IP address and port number and defines workstation access as "open" or "closed." Open access permits workstations to get onto the Internet when the Echo service is not running; closed access turns the Web faucet off when the Echo service is unavailable. We set the automatic installation to run on each client at login. Four of 20 clients failed the install because they lost communication with the Echo server. Put off but not out, we then reinstalled successfully.

Take note that to uninstall client software, communication with the server and the administrator password are required.

The Echo client software runs as a service (rnapp.exe) and uses 1,868 KB of RAM. Although we had no conflicts with other software running on our clients, we recommend further investigation before you purchase Echo for an enterprise setting.

Echo's real-time monitor began to display the fruits of our labor in the form of HTTP traffic. We kept an eye on the monitor, but no more traffic entered the screen. We reacted with a knee-jerk motion to the F5 key, loading the monitor with updated traffic. For those who have time to sit around and watch a monitor, live traffic beats a static picture. Yet, the static approach does have its advantages in cases where several actions can issue from the log file -- for example, export as a Web file. We tested Echo's monitoring abilities with 20 clients, requesting 1,000 pages in two minutes. Echo captured 989 pages, or 99 percent of pages, edging out eSniff in this category. After refreshing the monitor, we could easily sort by site because the log file provided total hits per site.

Echo's built-in reporting capabilities pale in comparison with those offered by Elron's IM and SuperScout, however. For example, Echo can generate top-10 lists for Web, FTP, e-mail and other activities, but detailed reports are available only by exporting the log files to a spreadsheet. When we exported the log file for reporting, we were pleasantly surprised to find the MAC addresses of workstations associated with log entries. A big benefit with installing client code: no spoofing.

Although Echo edged out eSniff in HTTP monitoring, it does not monitor telnet traffic, and its built-in reporting capabilities need to be improved to compete with rivals. One key point: If your enterprise has remote users to monitor, Echo provides the only solution for you to look at in this roundup. As long as the client can communicate with the server, Echo services will monitor remote users and scale accordingly with its client/server architecture.

Pearl Echo 4.0 Global Internet Management. Available: Now. Pearl Software, (800) 732-7596; fax (610) 458-5189. www.PearlSoftware.com