Monitoring, analyzing, and controlling your Internet traffic

Your employers can't legally eavesdrop on your telephone conversations, but they can still snoop into your network access. Kansmen has developed LittleBrother, a software product for the Orwell enthusiast in all of us for peering into our fellow workers' Internet access.

LittleBrother monitors, analyzes, and controls the Internet traffic on your LAN. It runs under Windows NT or Windows 95, and it doesn't require much technical skill to use. You don't need to reconfigure your network to start monitoring Internet activity on your LAN; you just need a PC with an Ethernet connection. The standard edition of LittleBrother lets you view Internet traffic. The professional (Pro) edition provides the same monitoring and reporting features as the standard version plus tools for blocking access to specific Web sites.

Reports
LittleBrother inspects all the traffic on the LAN and breaks it out into Web, FTP, and newsgroup traffic by user, site, protocol, bytes transferred, and capacity used. This breakdown includes how much bandwidth each application (e.g., Web, FTP, Telnet, mail, news) uses; who uses the most resources, as you see in Screen 1; and which sites users visit the most, as you see in Screen 2. You can choose from several reporting and viewing options to display the results. The software lets you use bar graphs and line charts to summarize the network traffic. It can also show you the name or IP address of any sites your users are accessing, although you can't see what users are doing on those sites. You can generate reports for Top Talker, Top Site, User Detail, Site Detail, Daily and Hourly Overview, IP Tables, and an Overview.

The Top Talker report lists usage per user in descending order. The Top Sites report lists each site that users access as measured by time or volume. The User Detail and Site Detail reports list the users and the sites they access. The Daily and Hourly reports display each day's and hour's usage. The software rates usage within these reports as productive, unproductive, neutral, and not rated. You can generate reports showing all the ratings or just some of them. These reports give you an overview of how productive or unproductive your Internet access is each day or hour.

LittleBrother has more than 40 different categories, such as Education, News, TV/Video, and Sex/Porn, which you can edit with the separate site rating utility that comes with the software. Administrators can provide a rating (Productive, Unproductive, Neutral, or Not Rated) for each category. Each of the ratings displayed in the reports has a unique color. Administrators can also password protect site ratings to prevent users from modifying access permissions or site ratings.

To help identify the users on your network and their configuration, the IP Tables report shows the properties, including IP Address, Machine Address, Computer Name, User Name, and LAN Adapter Vendor, for each computer. Finally, the Overview report shows the overall Internet traffic pattern of your LAN. The first section divides all Internet traffic into the four different ratings, and the second section notes all Internet traffic by the different categories.

Access and Blocking
In addition to providing Internet access monitoring, LittleBrother Pro lets you build access rules to permit or prevent access to specific Web sites. You can specify a site by domain name or IP address, or you can specify a group of sites by selecting a category.

These access rules are LittleBrother Pro's most powerful feature. Site blocking is rules-based, so setting and updating access privileges for individuals or whole groups is easy. You can also enable access privileges according to the time of day. This capability lets you block certain sites company-wide, enable certain groups to view select sites, and allow free access after work hours or during lunch. The rules are easy to edit, and you can add new rules as needed.

LittleBrother's Alert feature has editable rules for daytime and nighttime usage. This feature notifies you when a condition has been met according to volume or time of use. For example, if an employee has more than five hours of use during regular business hours, the software can automatically generate a report and alert you through email. Also, if you want the software to inform you of network traffic during non-business hours, you can establish separate restrictions to generate alerts for such traffic. One final feature of note is Export Data. It automates exporting the data that LittleBrother generates as either a .csv or .html file.

Usability
The LittleBrother software interface falls prey to a common defect, a poorly designed shortcut bar. Kansmen would have been better off foregoing the shortcut bar and leaving the commands in the menu. For starters, the GUI needs the icon police. I suggest Kansmen hire a graphics designer and listen.

The shortcut bar icons look amateurish, as if someone created them in Paintbrush, and the implementation is confusing. For example, the button for Top Talker is a stickman with a halo. But top talkers (users who spend the most time on the Web) could, in reality, be spending all their time on the Church of Satan Web site. So the halo doesn't seem intuitive. The Top Site icon is a capital W with a halo. Where did the W come from? Only Kansmen knows.

I also found the node filter icon confusing. It looks like a plastic champagne flute. I think Kansmen was trying to make the icon look like a funnel, but if you are filtering out sites, you don't want to funnel them through.

Despite these inconsistencies, the color-coding and labeling on the bar graphs is intuitive and clean. However, I would prefer to drag and resize the left frame to better use the real-time information. The Kansmen splash screen appears in the right frame until you generate a report. This display seems like a waste of space. Also, the title bar on the reports needs to better reflect the content of the report. For example, both the Top Talker Productive and Top Talker Unproductive report windows have the same title, "Top Talker."

Documentation comes in the form of a 46-page user's guide, which you will probably never need. Online Help built into the program and from the LittleBrother Web site is available. For tech support, you must contact your reseller.

Does It Work?
LittleBrother does what it is supposed to do--audit network traffic, generate detailed reports, and block unauthorized access. However, this program won't solve all your problems. For example, if you want to block user access to sites that LittleBrother categorizes as Sex/Porn, you are creating a lot of work for yourself. Blocking the big name sites such as playboy.com is easy, but hundreds of new sex sites appear every day, and many sites get around IP blocking by changing their IP address regularly. Also, sites with unremarkable front ends may hide material you want blocked. Browsing every site that appears as unrated and determining its content can be time consuming.

Kansmen has full-time employees who do nothing but categorize Internet sites. According to the LittleBrother user's guide, the package price includes a years' worth of category updates, which you can download from the Kansmen Web site. The updates are posted every two weeks. Unless the company has more resources than Yahoo!, it will have a hard time staying on top of the hundreds of Web sites that appear, disappear, and change every hour around the globe.

Although I agree that lost productivity is a problem, the shortage of IT professionals is worth mentioning. Many such professionals will view the type of intrusiveness that this product allows as a signal to dust off their resumes. Keep in mind what LittleBrother could do to morale in your department. Is it worth it? You decide.

LittleBrother 1.5
Contact: Kansmen * (408) 263-9881
Web: http://www.kansmen.com
Price: $295 LittleBrother (10 Users), $495 LittleBrother Pro (10 Users)
System Requirements: Minimum 486/66 with 16MB of RAM; recommend Pentium 133 with 32MB of RAM; Windows NT 3.51 (Workstation or Server) or higher and Windows 95; Network Interface Card; Workstation must be directly connected to the LAN being monitored; 30MB of available hard disk.