Network Computingwww.networkcomputing.com

PacketMotion PacketSentry 2.0.3

Posted by John H. Sawyer on February 13, 2006

Tags: Active Directory,  IM,  John H. Sawyer,  Oracle,  PacketMotion,  network forensics,  network monitoring,  peer-to-peer,  product review,  review,  security,  user monitoring,  Data Protection,  PacketSentry,  Security and Privacy

Channel: Data Protection

Mix a pinch of Microsoft Active Directory, a dash of network monitoring and an ounce of paranoia, and what do you get? A product to satisfy the questions you have about what your users are doing on your network, in the form of PacketMotion's PacketSentry. Were your interns using instant messaging again when they should have be working on the final draft for their summer project? Did your contractor access the financial share on one of your servers? PacketSentry lets you know by correlating network activity to the users responsible.

Good • Client interface quick and intuitive • Supports Active Directory for user, group and host enumeration • Excellent reports for compliance needs or simply showing what happens on the network Bad • Doesn't support directories other than Active Directory • Requires Oracle database • Custom network applications not recognized initially PacketSentry, $50,000 including Probe, Manager, Database, on-site installation and initial training. PacketMotion, (408) 449-4300. www.packetmotion.com

I tested PacketSentry, which consists of probe and manager appliances and an Oracle database server for storing data collected by the probe, in our University of Florida Real-World Labs®. The probe is a 2U appliance designed to hang off a monitoring port or network tap. Ideal placement is directly in front of a server farm to monitor all activity to and from the servers, or at the Internet boundary of a remote office to monitor all inbound and outbound traffic. For my tests, I set up a small network with several Microsoft Windows XP hosts and a Windows Server 2003 server providing Active Directory services, DNS and file sharing.

PacketSentry Client Manager Click to enlarge in another window

The PacketSentry Manager 1U appliance can be placed anywhere on the network, provided that it is accessible to the appropriate administrators. The PacketSentry client software must be installed on a Windows PC to connect to the manager. The manager appliance has a 10/100-Mbps network port, while the probe supports only gigabit copper or fiber. Companies without gigabit network links will need to purchase a 100/1000 media converter.