An access gateway monitors a communication session to a first host for commands entered by a user. For example, commands entered in a command line terminal by the user. When a command is received, the access gateway receives information about an effect caused by the command on the first host. The access gateway determines if the effect results in an attempt to establish a communication session between the first host and a second host. For example, to copy files from the second host. In response to determining that the effect results in an attempt to establish a communication session between the first host and the second host, an action is generated. For example, the action may be to block the attempt to establish the communication between the first host and the second host.