I am working on small project. There is an organization in which it has 100 around systems across the country. All of their machine's traffic goes through a single proxy monitored and maintained by the organization. Proxy is configured to use only white listed websites such as www.google.com and many others.(I am not aware about the proxy configuration that, are they using content based filtering or website URL based filtering? ).
If a machine sends traffic out of white listed domain, proxy alerts and then I need to manually analyze the machine.
How can I know due to which application/port/running process that traffic is occurring?
Is there any other way to stop this? Malware scanning tools identified nothing on the system.
If I recommend sysadmin to install disconnect, ghostery, blur, donottrackme and adblockplus like ad-dons will the number of reports generated by their proxy get reduced or not?
Any other permanent solution or global setting solution?