If someone is connected through VPN on a server is it possible to tell if he is copying and pasting files (from server on their computer) inside a Remote Desktop Connection session?
1 Answer
If someone is connected through VPN to your network it acts like he was in the Local Area Network. So the main question is:
Can we tell if someone is copying a file from the LAN?
Theoretically there should be a way to filter this with a program called Wire Shark (or similar)
What You should do is filter NFS traffic:
Display Filter
A complete list of NFS display filter fields can be found in the display filter reference
Show only the NFS traffic:
nfs
You cannot directly filter NFS while capturing. However, if you know the port used (see above), you can filter on that one.
Capture NFS traffic over the default port (2049)
https://wiki.wireshark.org/Network_File_System
Edit:
I have found a more in-depth answer here on Super User that confirms and completes my theory:
How to record traffic which is inside a VPN?
After some further research, I found that there is a more ideal software for this purpose called Microsoft Network Monitor
HOW TO: Capture network traffic on the VPN Server
We recommend using Microsoft Network Monitor when capturing network traffic on the VPN Server, this since Network Monitor seems to be better at intercepting all traffic from the VPN Server filter.
Wireshark only seems to capture packets sent to the VPN Server not from the VPN Server.
The Network Monitor capture file format can be used by Wireshark so the capture can be viewed using Wireshark if you prefer that.
Network Monitor Quick Guide
Create display filer for specific IP address:
-under the Capture tab -in the Display Filter window -select Load Filter->Standard Filters->Adresses->IPv4 Adresses -modify "IPv4.Address ==" to the address you are interested in and press Apply
To show IP addresses not host names in captures:
-under the Capture tab -in the Frame Summary window -select Columns->Choose Columns... -replace "Source" with "Source Network Address" and "Destination" with "Destination Network Address"