Seeing who is on the network and a bit more

[phil at 1918.com (Phil Buckley)]

I have a client that I do basic server admin for remotely. Nothing very
difficult, mostly just add new email addresses now and then.

I originally installed his rh7.2 system to be a gateway, and dhcp
server mostly. He is having a problem with one person in the building
that plugs into his network for access, and he fears that the person is
up to something fishy...

Is there a way for me to keep an eye open on just that one machine that
doesn''t require alot of effort on my part?

I was reading an article about SAINT in one of the linux mags last
week, but haven't tried anything like that... would that be the answer?

Any ideas are greatly appreciated.

Phil