Association of network traffic to enterprise users in a terminal services environment
View Patent ↗A solution for associating network traffic to enterprise users in a terminal services environment includes, at a network device configured as a terminal server, monitoring outbound network connections. If an outbound network connection is detected, a record is created indicating an association between the network connection and an enterprise user that initiated the network connection. The record is reported to a remote packet monitor which maintains a permanent log of the record. The permanent log may be used for tagging observed network traffic with an owning user.
1. At a network device configured as a terminal server executing at least one process, a computer implemented method comprising:
monitoring for an outbound network connection;
identifying a process, from within the processes executing on the terminal server, that initiated the outbound network connection;
accessing an operating system process table to identify an entry in the table that corresponds to the process;
extracting information from the entry to identify a user that owns the process;
creating a record indicating an association between the outbound network connection and the user; and
reporting the record to a remote packet monitor.
2. The method of claim 1 wherein the monitoring is performed by a network driver of the terminal server.
3. The method of claim 1 wherein the creating and the reporting are performed by a Windows service of the terminal server.
4. The method of claim 1 wherein
the creating comprises using a process ID to identify the entry in the the operating system process table; and
the record indicates the user and a source port of the terminal server used to make the network connection.
5. The method of claim 4 wherein the creating further comprises using a thread ID to uniquely identify the entry.
6. The method of claim 4 wherein the record further indicates date and time information.
7. The method of claim 1 , further comprising tagging observed network traffic data with an owning user based at least in part on the record reported to the remote packet monitor.
8. A network device configured as a terminal server executing at least one process comprising:
a memory; and
one or more processors configured to:
monitor for an outbound network connection;
identify a process, from within the processes executing on the terminal server, that initiated the outbound network connection;
access an operating system process table to identify an entry in the table that corresponds to the process;
extract information from the entry to identify a user that owns the process;
create a record indicating an association between the outbound network connection and an user; and
report the record to a remote packet monitor.
9. The network device of claim 8 wherein the monitoring is performed by a network driver of the terminal server.
10. The network device of claim 8 wherein the creating and the reporting are performed by a Windows service of the terminal server.
11. The network device of claim 8 wherein
the creating comprises using a process ID to identify the entry in the the operating system process table; and
the record indicates the user and a source port of the terminal server used to make the network connection.
12. The network device of claim 11 wherein the creating further comprises using a thread ID to uniquely identify the entry.
13. The network device of claim 11 wherein the record further indicates date and time information.
14. The network device of claim 8 , further configured to tag observed network traffic data with an owning user based at least in part on the record reported to the remote packet monitor.
15. A non-transitory machine readable storage medium embodying a program of instructions executable by a machine configured as a terminal server executing at least one process to perform a method, the method comprising:
monitoring for an outbound network connection;
identifying a process, from within the processes executing on the terminal server, that initiated the outbound network connection;
accessing an operating system process table to identify an entry in the table that corresponds to the process;
extracting information from the entry to identify a user that owns the process;
creating a record indicating an association between the outbound network connection and the user; and
reporting the record to a remote packet monitor.
16. The non-transitory machine readable storage medium of claim 15 , further comprising tagging observed network traffic data with an owning user based at least in part on the record reported to the remote packet monitor.
17. The non-transitory machine readable storage medium of claim 15 wherein the monitoring is performed by a network driver of the terminal server.
18. The non-transitory machine readable storage medium of claim 15 wherein the creating and the reporting are performed by a Windows service of the terminal server.
19. The non-transitory machine readable storage medium of claim 15 wherein:
the creating comprises using a process ID to identify the entry in the operating system process table; and
the record indicates the user and a source port of the terminal server used to make the network connection.
20. The non-transitory machine readable storage medium of claim 19 wherein the creating further comprises using a thread ID to uniquely identify the entry.
21. The non-transitory machine readable storage medium of claim 19 wherein the record further indicates date and time information.