2. Function, Operation

2-29

When NetSkateKoban is introduced for the purpose of detecting PC movement between locations, if a PC that was previously detected by Sensor A is later found on another day by a different Sensor B, is it possible to determine from the console screen or elsewhere that it had been detected by Sensor A in the past?

Even if the device moves before its previous connection information is determined to have ended, when the device is detected by Sensor B, it is recognized as having moved to another network. The connection in the network monitored by Sensor A is then recorded as terminated, and a new detection is recorded in the network monitored by Sensor B.

In advanced policy settings, by adding items related to previous connection information to the email notification format, you can determine that the device had been detected by Sensor A in the past.

In addition, when you hover the mouse cursor over a device icon in the detailed view of the network map, or when you click a device entry in the "Detected Devices (Current)" list in the Koban Browser, the previous connection information is displayed in a tooltip.

[Example of an email notification when advanced policy settings are applied]

Date                            : 2006-10-26 10:03:15
Warning                         : Unregistered device detected
IP Address                      : 192.168.60.247
MAC Address                     : 00:16:76:ii:jj:kk
Manager                         : 192.168.0.nn
Detecting Sensor                : KobanSensor@1F-MY-DOMAIN
Detecting Sensor Address        : 192.168.60.50
Detecting Sensor Interface      : fxp1
Detected "Location"             : ICR-bldg\BF\Cysol-NOC\B102
Detected "Domain"               : vlan60
Detected "Group"                : Cyber Solutions Inc\CSS
Manufacturer                    : Intel Corporation 

Previous Connection Information : Available
Date                            : 2006-10-25 12:02:57
IP Address                      : 192.168.100.249
Previous Detecting Sensor       : KobanSensor@3F-MY-DOMAIN 
Previous Sensor Address         : 192.168.100.11
Previous Sensor Interface       : eth0