Network Security software -- Sygate Personal Firewall



Network Security software –

Sygate Personal Firewall 5.0 (SPF)

Lab Tutorial

SPF Introduction

Sygate Personal Firewall offers unparalleled protection against malicious intrusion attempts by hackers, script kiddies, and cracks. It has the combined power of bi-directional intrusion detection, vulnerability assessment, and extensive logging and forensics capabilities.

• Protects against Trojans, spyware, worms and other known & unknown threats

• Prevents unauthorized or malicious applications from bypassing the firewall

• Enables even inexperienced users to easily customize and fine-tune security policies

• Provides best of breed evidence logs for intrusion analysis

• Easiest-to-use PC firewall and still free for personal/home use

Download and Installation

SPF 5.0 is free for download and personal/home use. You can download it at . (You’ll be redirected to )

Same as any other windows application, the installation is quite simple. Double clicking the downloaded file, spf.exe, you can start up the installation. The steps you’ll go through are shown as follows.

After restarting your computer, you can see SPF icon in the system tray.

Un-installation is simple also. Select uninstall Sygate Personal Firewall from the program menu, and answer “yes” to the following dialog box. You need to restart your computer to fully uninstall it.

Features of SPF

Main Console

The main console of Sygate Personal Firewall provides constant, real-time updates on your computer's network traffic, application status, and security level. From the main console, you can navigate to anywhere else within the firewall.

Traffic History Graphs

The most noticeable feature of Sygate Personal Firewall is the set of Traffic History graphs that are located below the toolbar on the main console.

The Traffic History graphs produce a real time picture of the last two minutes of your traffic history. The graphs reload new information every second, providing instant data, as measured in bytes, regarding your incoming and outgoing network traffic. Additionally, the Attack History graph on the right side of the console provides information on attempted attacks against your machine.

Hide Broadcast Traffic: Below the Traffic History graphs are two checkboxes. The Hide Broadcast Traffic checkbox, if checked, will prevent broadcast traffic from being displayed in the Traffic History graphs. This will minimize the appearance of traffic by limiting the display to unicast traffic only.

Running Applications List

The Running Applications list, which is located below the traffic flow graphs, displays all applications and services that are currently accessing (or attempting to access) your network connection. The status of the applications is also displayed:

|Icon |Meaning |

|[pic] |If an application has a status of "Allow", and is accessing your network connection, it is displayed as a normal |

| |icon. |

|[pic] |If an application has a status of "Ask" and is accessing your network connection, it's icon will be displayed |

| |with a yellow question mark over it. |

|[pic] |If an application is being blocked, its icon will be displayed with a red circle and cross mark over it. |

|[pic] |If an icon is displayed with small blue dots over the lower-left or lower-right corners, then the application is |

| |receiving (left dot) or sending (right dot) traffic through your network connection. |

You can change the size of the icons and the information displayed within the Running Applications field by right-clicking within the field and selecting the desired view from the list of options provided. Alternately, you can open the view menu at the top of the main console, and select the desired view from the list provided.

Logs

Understanding Logs

In Sygate Personal Firewall, a log is a record of information attempting to enter or exit you computer through your network connection. There are four separate logs that monitor different aspects of your network connection.

Logs are an important method for tracking your computer's activity and interaction with other computers and computer networks. They particularly useful in detecting potentially threatening activity, such as port scanning, that is aimed at your computer.

To view the different logs available in Sygate Personal Firewall, click on the Logs icon on the toolbar at the top of the main screen.

Click icon to view security log

OR click down arrow and select log type

There are four different log types in Sygate Personal Firewall: System Log, Security Log, Traffic Log, and Packet Log.

System Log

The System Log records all operational changes, such as the starting and stopping of services, detection of network applications, software configuration modifications, and software execution errors. The System Log is especially useful for troubleshooting Sygate Personal Firewall.

Traffic Log

The Traffic Log records every packet of information that enters or leaves a port on your computer.

Packet Log

The Packet Log captures every packet of data that enters or leaves a port on your computer. The Packet Log is disabled by default in Sygate Personal Firewall because of its size.

To enable the Packet Log, open the Options window by selecting Options... from the Tools menu. Click on the Log File tab and click the check box next to the text Enable Packet Log. Then click Apply.

Security Log

The Security Log records potentially threatening activity directed towards your computer, such as port scanning, or denial of service attacks.. The Security Log is probably the most important log file in Sygate Personal Firewall.

Back Tracing Hack Attempts and display hops information

From the Security Log file, click on the event you want to back trace so that the entire row is highlighted.

• Either right-click the row and select Back Trace from the pop-up window, or click the Action menu and select Back Trace.

• Sygate Personal Firewall will back trace the event information. The Back Trace Information window will open, displaying a trace route log.

• To view detailed information on the original IP address, click the Whois>> button at the bottom of the Back Trace Information window. A drop panel appears, displaying detailed information about the owner of the IP Address from which the security event originated.

• Click the Whois ................
................

In order to avoid copyright disputes, this page is only a partial summary.

Google Online Preview   Download