+-------------IRIS -- INTOUCH Remote Interactive Supervisor V1.0-------------+ | Session Status Reports Maintenance General Advanced Exit | +---------------------------------+---------Maintenance----------+-----------+ | Domains | | Purge and Archive Records | +------------------------------+

Domains	Performs maintenance on domain file records. The domain file contains domain names, IP addresses and information about them. The domain maintenance options allow you to: Add new domain name records to the domain file Change or update data in the domain records Delete domain records from the file Review or inquire on domain name/IP address information
Purge and Archive Records	Allows you to purge and/or archive records from the recordings and/or audit files. You select which records in the files to purge/archive. You can select records by date, user name, and location.

A.1.5 General Menu Options

+-------------IRIS -- INTOUCH Remote Interactive Supervisor V1.0--------------+ 
|  Session    Status    Reports    Maintenance    General    Advanced    Exit | 
+------------------------------------------------+--General--+----------------+ 
                                                 |  Email   | 
                                                 +----------+ 

Email

You are placed in the email utility. The screen clears and the MAIL> prompt is displayed. You can read or send mail messages. You can get help on using the mail utility by entering HELP at the MAIL> prompt. When you have finished and want to return to the General menu, enter EXIT at the MAIL> prompt and the menu will be displayed.

A.1.6 Advanced Menu Options

+-------------IRIS -- INTOUCH Remote Interactive Supervisor V1.0-------------+ 
|  Session    Status    Reports    Maintenance    General   Advanced    Exit | 
+------------------------------------------------------------------------------+ 
                 +--------Advanced---------+ 
                 |  Configure            [>| +----Configure----+ 
                 |  Control IRIS         [>| |  TCP/IP Ports   | 
                 |  Software Upgrade       | |  TCP/IP         | 
                 |  System               [>| +-----------------+ 
                 +------------------------+ 
                                             
                                             +---Control IRIS----+ 
                                             |  Shut down IRIS           | 
                                             |  Restart IRIS             | 
                                             +---------------------------+ 
 
 
                                             +---------System----------+ 
                                             |  Change Date and Time   | 
                                             |  System Shutdown        | 
                                             +-------------------------+ 

TCP/IP Ports	Allows you to set up HTTP and/or FTP proxy port numbers and SMTP and/or DUMP port numbers.
TCP/IP	Allows you to shut down, start up and/or configure TCP/IP services.
Shut down IRIS	This is a special procedure that shuts down IRIS. This procedure should be run only when instructed to do so by TTI technical support.
Restart IRIS	This is a special procedure that restarts IRIS. This procedure should be run only when instructed to do so by TTI technical support.
Software Upgrade	Upgrades the IRIS box with a new version of the IRIS software. This procedure performs the software upgrade installation.
Change Date and Time	Allows you to change the system date and time. The current system date and time are displayed and you are asked to enter a new system date and a new time.
System Shutdown	If you select YES, the system is shut down in an orderly manner. If NO, the system is not shut down and you are returned to the System menu.

The following provides information on the INTOUCH Remote Interactive Supervisor features/procedures. This list can be used as a guide when working with IRIS.

Sessions

Once the current active sessions are listed, any session's data can be reviewed and session actions taken. The following session procedures can be performed:

• Display all current active sessions
• Display detail information for a session
• Watch a session's keystroke activity in real-time
• Get a snapshot of a session's current activity
• Record a session's current activity
• Play back a current session that has been recorded
• Disconnect a session having an IP address
• Show data summary for a current session

IRIS Reports

Customized reports can be created, as well as various network activity and email reports.

• Recordings Report - shows recorded sessions
• Active Browsers - browser activity for last thirty minutes
• URL Accesses - URL accesses by browsers since a specified date
• Browser Accesses - browser activity since a specified date
• Audit Report - internal activities of the IRIS system
• Top Browser Accesses - most active browsers by WWW pages accessed
• Top IP Connections - most active network connections in K bytes
• Top URL Connections - most active IP address and URL connections
• Top IP Address - most active IP addressed systems on network by K bytes
• Top URL Accesses - most accessed URLs
• Top Email Reports - most active email addresses by count and volume
• Top Email Correspondence Reports - most active sources, destinations by count and volume
• Archive Reports - reports on archived recordings and audit data

TCP/IP Services and Ports

TCP/IP services can be started and configured so that IRIS can:

• Resolve IP addresses --- get and use domain names
• Receive packet data from Transport Agents
• Send email from the IRIS box to some other CPU
• Access the IRIS box from another CPU

The following TCP/IP ports can be configured:

• HTTP and FTP --- proxy port numbers can be set up for non-normal port numbers
• DUMP --- set up to dump data for a given service port

Other Features

• Play back previously recorded sessions.
• Set up and maintain domain names.
• Purge and/or archive records from the recordings and audit files.
• Display IRIS status information such as packet counts.
• Status report of ethernet and TCP/IP statistics.
• Access to the Email utility without exiting out of IRIS.

This appendix contains examples of reports.

C.1 Recordings Reports

The following is an example of a Summary Recordings Report.

23-Feb-1999 IRIS -- INTOUCH Remote Interactive Supervisor 04:24:07 PM Summary Recordings Report File: ----- current Selection criteria: ------------------- Begin date: Earliest End date : Latest User names: ALL Locations : ALL Sort order: ----------- 1) Recording start date 2) Recording start time 3) User name 4) Location 23-Feb-1999 IRIS -- INTOUCH Remote Interactive Supervisor Page 1 Summary Recordings Report Date Count Percent ----------- ----------- ------- 06-Jan-1999 2 50.00 02-Feb-1999 1 25.00 15-Feb-1999 1 25.00 =========== ======= =========== ======= 4 100.00

C.1.2 Detail Recordings Report

The following is an example of a Detail Recordings Report.

23-Feb-1999 IRIS -- INTOUCH Remote Interactive Supervisor 04:26:25 PM Detail Recordings Report File: ----- current Selection criteria: ------------------- Begin date: Earliest End date : Latest User names: ALL Locations : ALL Sort order: ----------- 1) Recording start date 2) Recording start time 3) User name 4) Location 23-Feb-1999 IRIS -- INTOUCH Remote Interactive Supervisor Page 1 Detail Recordings Report Date Time User Location Size Count ----------- -------- ------------- ----------------- ------ ----- 06-Jan-1999 08:07:26 ALLEN LAT 1.240:1 151 KB 10:03:19 JEANNIE LAT 1.117:1 4 KB ===== 2 02-Feb-1999 11:23:47 ALLEN LAT 1.16:1 10 KB ===== 1 15-Feb-1999 14:43:43 ALLEN LAT 1.8:1 21 KB ===== 1 ===== ===== 4

This appendix contains a list of frequently asked IRIS questions.

D.1 Questions and Answers

Since there are two ethernet controllers on one IRIS machine, can they monitor two LANs (or sub-LANs) at once? And, if so, will IRIS Manager combine the two or show them separately?

IRIS has two ethernet controllers so we can monitor two LANs at once with a single IRIS box. Since all we track are packets and sessions by IP (or LAT) address . . . the data is merged on the reports. In later versions we will look at LAN-specific reporting.

Where do I put IRIS on my Network?

IRIS needs to be on an ethernet segment of your network. You want to place IRIS on a segment that sees as many packets as possible.

With IRIS can we have more than one monitor? And, does the monitor have to be solely dedicated for the purpose of IRIS, or can they be using the monitor for other things and a window for IRIS?

If a PC or workstation is running X-windows software, then it is possible to redirect IRIS screen displays to a given PC or workstation. However, all interaction with IRIS (for security reasons) must happen at the IRIS console.

What happens when the number of seats limit is reached? Are some packets skipped and not read?

When the seats limit is exceeded, packet processing slows down and sessions reconstruction slows down. No packets are dropped.

IRIS sounds like a packet watcher which looks for packets going across the network. True?

Close. IRIS is a stand-alone box that reads the packets in real-time, reconstructs all user sessions in real-time, and then scans all of them in real-time.

How can IRIS monitor all the activity?

Touch Technologies, Inc. has spent years developing the algorithms used in scanning and monitoring network activity. Because of this, IRIS is an extremely efficient package.

We use an extremely fast RISC processor computer. Just a few years ago, the technology to perform this kind of monitoring activity was prohibitively expensive. Thanks to the decreasing cost and increasing power of the latest generation of computers, this kind of power is available at a cost that makes IRIS feasible.

This glossary contains general information.

DECterm: A window displayed on the terminal screen.

IP: Internet provider.

LAN: Local Area Network.

LAT: Local area transport --- such as a terminal server.

seat: The user in front of a keyboard.

WAN: Wide Area Network.