First of all, I'm not very up-to-date on the filtering techniques that are generally used.... but I'll give it a go:
All external traffic (mail, www, telnet, etc) passes through the central gateway between your comapnies network and the Internet. At the gateway, monitoring software can be installed.
Most protocols (like http) allow monitors to read exactly what is going on, which server is being accessed, and what the request was.
So if you make 2000 http requests a day (to yahoo, google, TFP, whatever) and 1000 of those go to TFP, then the software might sound an alarm.
If the monitoring software is a little smarter it can also keep track of 'sessions', which are consistent connections to HTTP servers. So if you browse TFP constantly, your browser re-uses the same connection. The monitoring software sees this, and can calculate the time you spend surfing...
Many possibilities exist, and many tricks are involved, but this is the general idea.
__________________
"Do not kill. Do not rape. Do not steal. These are principles which every man of every faith can embrace. "
- Murphy MacManus (Boondock Saints)
|