You can get a temporary demo of Computer Associate's Intrusion Detection for free (
If you have what I see most often as a "typical" setup for small companies -- a router, a hub or switch, and desktops, with DHCP assigned either by the router or a server -- then you can set up this to monitor all traffic that moves between the router and your network.
It's easy to do. If your company uses a single hub, you can use any other machine on the same hub to monitor all activity. If your company uses an unmanaged switch, the easiest thing is to GET a little hub and put it "between" the router and the switch, so that all traffic flows over the hub. Then you stick a monitoring machine on the hub.
So, once you've got a machine on a hub, you can start listening. There are free programs like ethereal that you can run even on windows, but if you don't have time to sit down and learn how to use them, the Computer Associates product is pretty easy (at least it was when I used it for someone a couple of years ago). You install the software and configure it appropriately (you need to be 'promiscuous')
. This software does the rest -- its primary function is to look for attacks on your network, but it will also tell you the websites everyone is visiting, even grouping them by sports, porn, job-hunting, etc. You can create rules that will deny or allow access to things like Kazaa, for example, and, oh yeah, if you're using POP you can read everyone's email and see everyone's password. (That goes for any packet sniffing software).
About the only thing you can do with your W2K server alone, if it's set up in the "typical" way, and you're using it for DNS, is to look through the DNS cache and see what sites have been resolved. That's sometimes enough to show management WHY you need monitoring/filtering software.
It's nice if you have a company policy in print available to all employees. It's not nice to just ambush them. Of course, it IS a company resource, and they shouldn't be doing private things anyway.
