Hostwatch - Watchguard Firebox X1000 User Manual

HostWatch

HostWatch is a real-time display of active connections
occurring on a Firebox. It can also graphically represent the
connections listed in a log file, either playing back a previ-
ous file for review or displaying connections as they are
logged into the current log file. HostWatch provides graph-
ical feedback on network connections between the trusted
and external networks as well as detailed information
about users, connections, and network address translation.
The HostWatch display uses the logging settings config-
ured with Policy Manager. For instance, to see all denied
incoming Telnet attempts in HostWatch, configure the Fire-
box to log incoming denied Telnet attempts.
The line connecting the source host and destination host is
color-coded to display the type of connection being made.
These colors can be changed. The defaults are:
• Red – The connection is being denied.
• Blue – The connection is being proxied.
• Green – The connection is using network address
translation (NAT).
• Black – The connection falls into none of the first
three categories.
Representative icons appear next to the server entries for
HTTP, Telnet, SMTP, and FTP.
Name resolution might not occur immediately when you
first start HostWatch. As names are resolved, HostWatch
replaces IP addresses with host or usernames, depending
on the display settings. Some machines might never
resolve and the IP addresses remain in the HostWatch win-
dow.
To start HostWatch, click the HostWatch icon
(shown at left) on the Firebox System Manager.
User Guide
HostWatch
97