Monitor for Client Connections to a Server over time

[LStone_AA]

How would you monitor and log client connections to a particular Geo SCADA server over time?

Say over the next three weeks, we want to know who/what/how many/how long any clients have connected via ViewX, WebX, VVX, data connections, etc etc.

How would you do it? Geo SCADA log settings/parsing, Windows features or any external tools or programs.

[AdamWoodlandToo · Accepted solution]

I'd possibly write a PowerShell script that parses the socket connections (i.e. netstat -ano, but see https://isc.sans.edu/diary/30532 for something more PowerShell) and calculates the numbers connecting to port 5481 from their source IP.

VVX can just be to IIS's ports.

WebX just to IIS or dbserver's web port (depending on Geo SCADA version).

Data connections will be tough as its to 5481 the same as ViewX so from a socket perspective you won't see a difference. If you do need to get to this detail, could parse the DBSnapshot files.