Collecting Packet Logs - Internet Security Systems RealSecure User Manual

Chapter 4: Configuring RealSecure Desktop Protector

Collecting Packet Logs

Introduction
Where are my
packet log files?
Packet log file
format
Procedure
Clearing packet logs To delete packet logs:
54
Packet logging records all the packets that enter your system. This can be useful if you
need more detailed information than evidence logs contain.
Desktop Protector packet log files are stored in the installation directory folder. For
example, if you install Desktop Protector in the Program Files directory on the C: drive,
the packet log files are located in C:\Program Files\ISS\BlackICE . Each file has an
extension.
*.enc
If you upgraded to RealSecure Desktop Protector 3.5 from a previous version of
Note:
BlackICE, your packet log files are still stored in C:\Program Files\Network
.
ICE\BlackICE
The packet log files are trace files. You must have a trace file decoding application to view
the contents of these files. Many networking and security product companies produce
such decoders. Some shareware decoders are also available on the Internet. If you are
using Windows NT or Windows 2000 Server, you can install the Network Monitoring
service, which includes Network Monitor, a decoding application. See the Windows NT or
Windows 2000 documentation for more information.
To collect packet logs:
1. From the Main Menu, click Tools
2. Select the Packet Log tab.
3. Select Logging Enabled.
4. In the File prefix box, specify the prefix for the packet log file names.
Desktop Protector automatically places an incremental counter in the filename. For
I
example, if you enter ABC, the file names will be ABC0001.enc , ABC0002.enc , and
so on.
5. In the Maximum Size box, specify how large each log file can get.
For best results, keep this value under 2048 kilobytes (2 MB).
Note:
6. In the Maximum Number of Files box, specify how many log files to generate.
The default is 10.
Note:
Packet log files are generated until the maximum number of files are used. Once the
maximum number of files are used, Desktop Protector starts replacing the first log file
with a new file, and so on.
1. From the Main Menu, select Tools
The Files to Delete window appears.
2. Select Packet logs.
3. Click OK.
Clearing packet log data does not affect the Desktop Protector intrusion detection
Note:
and firewall functions.
Edit BlackICE Settings.
Clear Files.