Hostwatch - Watchguard Firebox FireboxTM System 4.6 User Manual

HostWatch

198.148.32.0
eth1:0
127.0.0.0
default
eth0
ARP table
A snapshot of the ARP table on the running Firebox. The ARP table is used to
map IP addresses to hardware addresses:
ARP Table
Address
207.23.8.32
207.23.8.52
207.23.8.21
201.148.32.54
201.148.32.26
207.23.8.30
Authentication list
The Authentication List tab displays the host IP addresses and user names of
everyone currently authenticated to the Firebox. If you are using DHCP, the IP
address—to—user name mapping changes whenever machines restart.
Blocked Sites list
The Blocked Sites List tab lists the IP addresses (in slash notation) of any external
sites that are temporarily blocked by port space probes, spoofing attempts, address
space probes, or another event configured to trigger an auto-block.
Next to each blocked site is the amount of time remaining on the temporary auto-
block. You can adjust the auto-blocking value from the Blocked Sites dialog box
available through Policy Manager.
You can selectively remove sites from this blocked list either by selecting the site and
clicking the X toolbar button or by double-clicking a site. If the display is in
continuous refresh mode (that is, if the Continue button on the toolbar is active),
selecting a site on the list or clicking the X button stops the refresh mode. (The X and
Continue buttons are grayed out unless the Blocked Sites list is shown.)
If you opened the Firebox with the monitoring (read-only) passphrase, Firebox
Monitors prompts you to enter the configuration (read-write) passphrase before
removing a site from the list.
HostWatch
HostWatch is a real-time display of active connections occurring on a Firebox. It can
also graphically represent the connections listed in a log file, either playing back a
previous file for review or displaying connections as they are logged into the current
log file. HostWatch provides graphical feedback on network connections between the
trusted and external networks as well as detailed information about users,
connections, and network address translation.
98
* 255.255.255.0
* 255.0.0.0
207.54.9.30 *
HWtype HWaddress
ether 00:20:AF:B6:FA:29
ether 00:A0:24:2B:C3:E6
ether 00:80:AD:19:1F:80
ether 00:A0:24:4B:95:67
ether 00:A0:24:4B:98:7F
ether 00:A0:24:79:96:42
U 1500 0
U 3584 0
UG 1500 0
Flags Mask
C *
C *
C *
C *
C *
C *
129
9 lo
95
Iface
eth1
eth1
eth0
eth1:0
eth1:0
eth0