Urgent Help needed!

[The_GuRu]

Hi all!

 

This is my first post on these forums, and hopefully not my last!

 

I work as a ICT and AV Technician at a school in gloucestershire.

 

I have a problem, our current network manager has accused me of browsing the internet while i should of been working. I deny this, however, he has produced what he claims, as factual evidence that i have been browsing the internet for 2 hours on one day.

 

This evidence was a report generated by Websense explorer (v6.3).

 

I do not dispute that the software is not accurate, on the contrary it appears to be very good. But, the URLs that websense has logged as my activity do not appear to be actual websites, however i believe they are in fact connections made to ad servers, by spyware cookies and in the case of urs.microsoft.com phishing data. (that is being sent back to microsoft). And also websites that contain google-analytics tracking code.

 

So what im asking, is if any of you guys can agree with me that, in fact, the websites in my picture are, mostly outside of my control. (i did not browse on them, the spyware did).

 

Any help would be much appreciated in this matter, as i would like to get my name cleared, for i have not done any wrong doing.

 

Thank you!

 

P.S. It is also part of my job to search for new AV and IT equipment, thus the main sites that i use for this is dabs and ebuyer.

 

Thanks!

 

This is the screenshot, this is not the only part of it, however, i felt that the first section contained enough for you guys to help me!

 

http://www.wdmcomputers.co.uk/snapshot.JPG

[GrumbleDook]

So, you left your browser open whilst ou did other things and the adware / banners kept a connection going whilst you didn't realise?

 

Fine ... test it. Tomorrow go to the bbc site for 10 mins and then to ne of the other sites for 15 mins, but click on nothing ... leave the browser and see what happens.

 

If things are the way you say they are this should generate enough evidence

[localzuk]

Hang on a sec. Are those times connection times? As in, the time that the server was communicating back and forth with the client? If so, then it would indicate that you had spent an awful lot more time online. Actually reading the stuff on sites takes a lot more time. I would say you could at least double the time for each site. And you can ignore all of the analytics details - as they can be initialised with Ajax on pages left open very easily. (Sites changing their adverts dynamically whilst you browse for example).

 

So, my guess would be that actual time browsing would be closer to an hour in total, with about 40 minutes of that being to dabs/ebuyer/microdirect.

[john]

The times shown are the total amount of time spent on that site / accessing that site in the specified period of the report, so if its for a 24hr period, then for example, dabs.com is 9mins 30 seconds in total in that 24hrs.

 

It will be banner ads, and others stuff some of it, mine probably logs high as i leave Live Messenger signed in 24x7 and other sites like BBC opened and minimised all the time etc

[tech_guy]

Your NM's a bit draconian isn't he/she?! And obviously doesn't understand what happens when you leave a browser open on a site that has banner ads....

[iatkinson]

Sounds like n your network manager doesn't know what he's doing. Explain to him slowly...the way we have to with teachers.

[localzuk]

The times shown are the total amount of time spent on that site / accessing that site in the specified period of the report, so if its for a 24hr period, then for example, dabs.com is 9mins 30 seconds in total in that 24hrs.

 

It will be banner ads, and others stuff some of it, mine probably logs high as i leave Live Messenger signed in 24x7 and other sites like BBC opened and minimised all the time etc

 

That doesn't explain anything I'm afraid - does it log the time the page is open on the client's machine or just time the time that data is passing back and forth between client and server? There would be a major difference between the 2.

[The_GuRu]

Thanks for the quick replies!

 

Its a good question, im not sure how websense is able to log the time on the net, ive searched their administrators guide and documentation on their site to no avail.

 

My understanding is that most websites, are not connection orientated, so im confused as to how it logs this.

 

Another concern i have is with Internet explorer 7, im sure like many of you, when a teacher rings or a job is placed on your helpdesk system you leave your pc, and everything that you were working on open on it until you come back.

 

If when i come back to the pc, and start accessing dabs, ebuyer etc again, will websense then say im still browsing on that particular site, even though i have been on a job for the last 10mins?

 

With IE 7, you can have multiple tabs/pages open at once in the same window........ is websense recording the activity of the other pages i dont have open and logging it has me actually browsing the net?

 

From what i am aware, websense it tied directly into our celestix firewall, and does not install client side software to aid its logging.

 

As a note, there is about 70 to 100 or more url entries to that log page, most of them are only 1 second long browse time and are ad servers or spyware cookies.

 

I would love to test out that theory, but the laptop i have been using for the last few months is not personal allocated one, i have been using and old tecra off the shelf(i have admittedly been told to bring my personel one in, however as i was only using it to access the help desk i did not see the need to). Thus the laptop is now gone, allocated to some teacher in a far gone area of the school.

 

My network manager has presented this to our business manager, so, it is not he i have to convice, it is my technically young business manger who has happily looked at the above evidence and taken it at face value, seen the total at the page end of 2hrs not having a clue what any of the log entries mean.

 

At the end of the day, atm, its my network mangers word against mine, and hes is the schools technical expert as such, and i am only a 'mere' technician.

 

So, i have a mamoth task ahead of me... theres alot of unbelievers that need to be enlightened, wish me luck!

[GrumbleDook]

Contact your union for assistance.

[ICT_GUY]

It looks to me that you have a non techie with a new toy. Also sounds as though he has no idea of how the internet works, how modern websites work or even a basic idea of how to interprete the information.

 

Best go to your union, also maybe fire a shot across his / her bow about bullying as this certainly counts as causing unfounded stress.

 

I spend a good proportion of my time on the internet, during downtime or whilst waiting for things to complete, doing research, keeping my knowledge up to date.

 

I have browsers open all day, google mail for one.

 

However I do not browse sites unrelated to work, except during lunch.

[Andi]

Does the work get done at your place or are there always a lot of jobs left? If everything runs pretty smoothly then maybe explain to your network manager that as everything is running well in between jobs you were researching prices for new kit for the school network.

 

He/she should understand, and if he/she really does have an issue then there's a trust issue at your workplace. My manager trusts me to get on with work that needs doing, and I do it. Because of this relationship I'm also able to browse the internet at work.

 

If there really is an issue then maybe an investment in some helpdesk software could be a worthy cause, as it will monitor the time spent on jobs.

[SimpleSi]

Scenario 1.

 

You are wasting company time and NM is out to nail you with hard evidence.

 

Good luck in trying to beat the rap

 

(Or just own up and don't do it again )

 

Scenario 2.

 

The NM thinks for some strange reason that you are wasting company time or doesn't like you and is just looking for an excuse to nail you.

 

Explain to (NMs) line manager that you are a good employee and ask for some time off normal duties to show how similar weblogs can be produced by just having a machine logged onto a legimate website while you are off doing other activities

 

Remember most humans operate on the smoke/fire scenario and are much more likely to believe the simplest explanation so you may have your work cut out .

 

Good luck again.

 

regards

Simon

PS back onto fixing network after power failure - this post was a test from the server to prove that the main connection is working

[Jona]

I think your in a pretty strong position since the top 3 sites in your screenshot are all advertising, etc. In fact most of the ones in that list are.

 

Perhaphs you should get your NM to run a log on his own internet usage to show the use of advertising / searching engine tracking / etc.

 

As far as I can see you went on dabs, nzhearld, google, ebuyer, microdirect, edinburgh.gov.uk. It would seem that most of these arfe justifiable and work related...??

 

Cheers

Jona

[enjay]

As far as I can see you went on dabs, nzhearld, google, ebuyer, microdirect, edinburgh.gov.uk. It would seem that most of these arfe justifiable and work related...??

 

I was thinking the same thing - you have some sites which are obviously banner adservers and a collection of sites which (with the exception of the NZ Herald) all seem business-related.

 

As others have suggested, is there perhaps a larger game of politics at play here? Is your NM "out to get you", as it were? Either way, accusations have been made about your effectiveness at work, and if I were you, I would get my union rep in on this.

[The_GuRu]

I was thinking the same thing - you have some sites which are obviously banner adservers and a collection of sites which (with the exception of the NZ Herald) all seem business-related.

 

As others have suggested, is there perhaps a larger game of politics at play here? Is your NM "out to get you", as it were? Either way, accusations have been made about your effectiveness at work, and if I were you, I would get my union rep in on this.

 

This is something i believe fully in, and my union rep has gotten involved in.

 

I would quite happily put my hand up, presented with evidence that i browse the internet, and admit to it. As at the end of the day, you cant dispute that, its your user account, your pc, in a secure workshop.... etc

 

However, as seen, this is not the case. Im not saying i dont browse the internet, just not for the amount of time that has been claimed. And its not like this isnt obvious, the first 3 sites in the list are clearly not urls that i have browsed to, however my NM has conviently not mentioned this to the higher powers. Its extremly frustrating as im sure you will agree.

 

Things are about to get interesting!

 

And a BIG thank you to all that have contributed to this thread so far, your help is greatly appreciated! Im Glad im not going mad! Drinks are on me! ;-)

[enjay]

However, as seen, this is not the case. Im not saying i dont browse the internet, just not for the amount of time that has been claimed.

 

Remember (or rather remind your NM) that Websense is only recording the amount of time those websites were displayed on your screen, not the amount of time you spent reading them.

[tech_guy]

Sounds like n your network manager doesn't know what he's doing. Explain to him slowly...the way we have to with teachers.

 

 

LOL Ace post!

[PEO]

your nm seem a little perfetic, why would he/she be monitoring you internet, just seems a little excessive.

[Bromcom_John]

Having just skim read through the Admin manual for this product you may want to ask for the same report to be run asking for Hits rather than time.

If your top site lists a low number of hits then that would lend strength to your banner ad argument.

Think about it, how many websites do you know that can actually keep anyones attention for 30 minutes solid without having to request new data, refresh content, navigate to a second page etc..

 

Websense considers a "hit" as one request for data from the listed URL. A banner ad or pop up is most likely going to ask for this stuff once and then just sit there. Whereas reading a news web site will list multiple hits for your one visit as you browse different news articles etc.

 

Also the Browse Time value is in itself a seperate report. Ask for the drill down data from the suspected adserver duration values. If it is an adserver then the information from this should lend weight to your "it was on and was left on" argument

 

oh and server.iad.liveperson.net is in fact a cookie which is used in quite a few common third party chat clients. If a regularly visited site uses one of these components then just visiting the site may very well install and activate the cookie (without actually initiating the embedded chat compnonent). More info can be gleaned from http://www.liveperson.com

Edited February 7, 2008 by Bromcom_John

[Joanne]

as long as you are doing your job properly what's the problem? So you go on the internet???? BIG DEAL. good job nobody monitors our internet usage here... all you'd get would be facebook and sky sports football.... honestly... if there is nothing better to do....

 

Look up your NM's browsing times and throw it in his face.

[tom_newton]

You are correct - the "stateless" nature of the web means it is near impossible to calculate browsing times - and certainly you cannot prove that someone was viewing the site. As product manager at SmoothWall, I have seen our similar report deprecated due to inaccuracy - we *may* reintroduce it if there's demand, and we feel it can be made accurate. Other companies may not be as bothered about reporting accuracy.

 

I would be happy to speak to your NM/Head/Union rep/any or all of the above and explain this from a position of impartiality, and reasonable knowledge in the field.

 

Certainly before taking action, the actual browsing logs should be examined in detail - smells of witch hunt to me.

[sahmeepee]

The browse time in Websense is defined by a user-configurable interval for how long a page should take to read. Each night, at 2am by default, it calculates all the browse times from the page hits and writes the results into the database.

 

The exact rules for browse time are available in the help for the database admin tool. Assuming you're on the most uptodate version of websense (6.3.1), it goes like this:

 

Internet Browse Time Configuration

 

Read Time Threshold (default - 3 minutes)

 

A session starts when a user opens a browser and HTTP traffic is generated. A session stays open as long as the user generates HTTP traffic with no time gap larger than the parameter set for the Read Time Threshold.

 

Note: Changing the IBT Read Time Threshold value will cause your Explorer IBT reports to be inconsistent. You should accept the default or change it as few times as possible.

 

Last Read Time (default - 3 minutes)

 

When the time gap of HTTP traffic is longer than the Read Time Threshold, the session is ended and the value of the Last Read Time is added to the session time. This is because it is assumed that there should be time associated with the last web page requested.

 

Click Update to set the edited Internet Browse Time Configuration options.

 

Note: After upgrade, these options return to the original default settings.

 

Basically, any time you hit a page a 3 minute session is started because it assumes a gap of any less than 3 minutes constitutes continuous browsing. As John Condon says, you can change from browse time view to hits view with one click. That will show you each hit for you on that day in "time sequence" order. Different people have different levels of detail stored in their databases - our database is currently at a rather chunky 20GB - to balance storage space against more detail.

 

I would question how meaningful the browse-time-by-hostname is in itself. If I'm on edugeek.net it also seems to log approximately the same browse time for http://www.edugeek.net for that day, presumably because the site is giving me data from both hostnames. These times are then added together despite running concurrently. As people have said there is also the question of banners etc automatically reloading, which Websense will see as new activity. Finally, the aggregate data doesn't tell you how much of the time was spent during working hours.

 

You really do need to see the time sequence data to make a fair assessment. It can be exported to PDF directly within the page via the PDF icon near the top-right of your screenshot.

[The_GuRu]

:pI do apologise for not replying for a while!

 

However i thought that you would like to know that the internet evidence presented against me has now been thrown out thanks to it not being true!

 

A panel of governors agreed that the evidence "did not stack up" and was thrown out!

 

I provided the links and print offs of the replies to this thread as evidence and also used the expert advice of my CCNA lecturer.

 

I Would also like to say a BIG BIG thank you to Mr Tom Newton who volunteed to be an impartial 3rd party to back me up if needed.

 

I cannot thank you enough for the support, speically as we have not met or know each other!

 

A Big thanks to everyone who helped contribute to the thread, i owe you all! Although im unsure of exactly how to repay you all...!

 

Thank you from one very happy IT Tech!! :);-)

[tech_guy]

Glad to hear everything worked out in your favour!

[MkII]

Great result! Well done