3

If someone is connected through VPN on a server is it possible to tell if he is copying and pasting files (from server on their computer) inside a Remote Desktop Connection session?

1
  • If you control the VPN server, you can observe bandwidth on RDP port to guess that. You can disable file transfer in terminal server as well... Sep 8, 2015 at 23:24

1 Answer 1

2

If someone is connected through VPN to your network it acts like he was in the Local Area Network. So the main question is:

Can we tell if someone is copying a file from the LAN?

Theoretically there should be a way to filter this with a program called Wire Shark (or similar)


What You should do is filter NFS traffic:

Display Filter

A complete list of NFS display filter fields can be found in the display filter reference

Show only the NFS traffic:
nfs

You cannot directly filter NFS while capturing. However, if you know the port used (see above), you can filter on that one.

Capture NFS traffic over the default port (2049)

https://wiki.wireshark.org/Network_File_System


Edit:
I have found a more in-depth answer here on Super User that confirms and completes my theory:

How to record traffic which is inside a VPN?


After some further research, I found that there is a more ideal software for this purpose called Microsoft Network Monitor

HOW TO: Capture network traffic on the VPN Server

We recommend using Microsoft Network Monitor when capturing network traffic on the VPN Server, this since Network Monitor seems to be better at intercepting all traffic from the VPN Server filter.

Wireshark only seems to capture packets sent to the VPN Server not from the VPN Server.

The Network Monitor capture file format can be used by Wireshark so the capture can be viewed using Wireshark if you prefer that.


Network Monitor Quick Guide

Create display filer for specific IP address:

-under the Capture tab -in the Display Filter window -select Load Filter->Standard Filters->Adresses->IPv4 Adresses -modify "IPv4.Address ==" to the address you are interested in and press Apply

To show IP addresses not host names in captures:

-under the Capture tab -in the Frame Summary window -select Columns->Choose Columns... -replace "Source" with "Source Network Address" and "Destination" with "Destination Network Address"

2
  • AFAIK, VPN tunnels are encrypted so WireShark won't do much in this case.
    – nKn
    Sep 8, 2015 at 21:54
  • @nkn - If I am right, VPN is only encrypted while it is on the internet.
    – Divin3
    Sep 8, 2015 at 22:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .