Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Our client has a Windows workgroup LAN with a UNIX/Oracle database server. We want a tool which can log login/logout details of network users to the database server. The problem is that we can't access the database server, although that would have been the easier solution, due to some company policy.

Below are some features needed for the tool:

  1. LOG user login/logouts of network users( i.e. user name, ip address)
  2. No workstation installation.
  3. No domain only work group LAN

We considered the following options:

  1. A proxy server in front of the database server. All traffic to the database server will pass through the proxy. But how will the proxy will capture the network usernames of users trying to login? Any tool suggestion?
  2. Switch port monitoring. But it will capture only the IP addresses of the users. How to capture the usernames/details?

Please suggest any tool or any other solution.

share|improve this question

closed as not a real question by Adnan, Terry Chia, Eric G, Noordung, NULLZ Jun 5 '13 at 23:35

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

1  
What kind of "login to the DB server" you need? To the console, X, or to the database server itself (what DB is that? PostgreSQL, MySQL, MongoDB...?) –  lserni Jun 5 '13 at 8:21
    
@lserni to the database server itself, DB is Oracle –  user1659459 Jun 5 '13 at 14:47
    
Logging database access should already be a part of your company policy. Ask for access to the user auditing capabilities that are built into Oracle. That really is the best answer, even if not convenient. –  schroeder Jun 5 '13 at 17:12
    
@schroeder I asked about it earlier, it is being maintained by some other company. However I will give lserni 's solution a try. –  user1659459 Jun 5 '13 at 19:17

1 Answer 1

up vote 1 down vote accepted

Not very easy to do that passively.

If the connection is not encrypted you might try adding a host "in front of" the database server, that will be able to intercept the Oracle conversations. A simple presentation here.

Wireshark is able to intercept and decode traffic (user and machine), so that and some filtering script can intercept the connections themselves.

To be able to log other traffic statistics, you'd need to write a specific application using libpcap.

That's all hacking, however. The "true" solution would be to work with the DB server accounting system. The hack version has the advantage of being passive, i.e. the server sees nothing amiss, and does not consume resources to perform logging and reporting; they are done in the sniffing "front end".

share|improve this answer
    
I will give your solution a try(Wireshark). –  user1659459 Jun 5 '13 at 19:16

Not the answer you're looking for? Browse other questions tagged or ask your own question.