A network attached apparatus, system, method and computer program product for identifying users of networked computers is provided. The apparatus is installed at core network uplink points and analyzes packets as they traverse the network and intelligently correlates the contents of the traffic with user contact and system access information. The resulting information is used to identify the user of the networked computer for security or accounting purposes.