EldoS | Feel safer!

Software components for data protection, secure storage and transfer

Monitoring Network Path

Also by EldoS: RawDisk
Access locked and protected files in Windows, read and write disks and partitions and more.
#16677
Posted: 06/16/2011 05:39:07
by Theo Z (Basic support level)
Joined: 05/03/2010
Posts: 26

Hi,

Does CallbackFilter support monitoring a network path? I've tried your C# FileMon sample program, put \\TZ-VISTA\Temp\*.* as a file path to monitor (where TZ-VISTA was a virtual computer on VMWare) and it didn't work. I used the latest version, i.e. v2.2.39 (May 7, 2011).

Please help.

Regards,
Theo
#16678
Posted: 06/16/2011 06:03:27
by Vladimir Cherniga (EldoS Corp.)

It supports Lanman redirector client for sure. What filter path returns in BaseFilter sample when you add rule ?
#16687
Posted: 06/17/2011 06:23:35
by Theo Z (Basic support level)
Joined: 05/03/2010
Posts: 26

Thanks for your response.

I've tried the BaseFilter sample, put \\TZ-VISTA\Temp\*.* on the mask text box, press Accept button and the Filter Mask column on the grid returned \Device\LanmanRedirector\TZ-VISTA\Temp\*.*.
#16690
Posted: 06/17/2011 07:01:56
by Vladimir Cherniga (EldoS Corp.)

Thank you for the information. Please describe in more details how to reproduce this problem (detail steps, host operation system, etc).
#16765
Posted: 06/21/2011 09:29:50
by Theo Z (Basic support level)
Joined: 05/03/2010
Posts: 26

Thanks for your response. To reproduce, just use the C# FileMon sample and put the network path in there. It doesn't work in here. I used Windows 7 64bit and Vista 64bit. Any other information you need?
#16773
Posted: 06/22/2011 01:27:58
by Vladimir Cherniga (EldoS Corp.)

I will check the issue in a short.
#16782
Posted: 06/22/2011 10:04:04
by Vladimir Cherniga (EldoS Corp.)

This is a problem resolving network UNC path name to device name in Windows Vista and 7. Try to change filter mask as follow: \Device\MUP\TZ-VISTA\Temp\*.*
#16814
Posted: 06/24/2011 12:22:25
by Theo Z (Basic support level)
Joined: 05/03/2010
Posts: 26

Thanks for the information. Yes, the filter mask above works if the activity (file open, read, write, etc.) happens on the local computer where the FileMon program is running. But if the activity happens on the remote computer (e.g. on TZ-VISTA computer), it doesn't work. Does the current library support this feature? If not, do you have any plan to support this on the future version?
#16815
Posted: 06/24/2011 13:12:24
by Eugene Mayevski (EldoS Corp.)

Do you mean having something on computer A and spying on disk activity on computer B? This is technically not possible unless you have an agent running on computer B and collecting the data for you.


Sincerely yours
Eugene Mayevski
#16819
Posted: 06/24/2011 13:18:53
by Vladimir Cherniga (EldoS Corp.)

You cannot monitor local activity on a remote computer. You may filter access from the local computer to the remote path (with installed filter on a local machine) or yo may filter a requests from remote computer to a local file system resource (setting filter on a local path). There is no other filter paths available.
Also by EldoS: Callback File System
Create virtual file systems and disks, expose and manage remote data as if they were files on the local disk.

Reply

Statistics

Topic viewed 5120 times

Number of guests: 1, registered members: 0, in total hidden: 0




|

Back to top

As of July 15, 2016 EldoS Corporation will operate as a division of /n software inc. For more information, please read the announcement.

Got it!