WatchGuard Firebox System 7.0 User Guide

HostWatchHostWatchHostWatch is a real-time display of active connectionsoccurring on a Firebox. It can also graphically represent theconnections listed in a log file, either playing back a previousfile for review or displaying connections as they arelogged into the current log file. HostWatch provides graphicalfeedback on network connections between the trustedand external networks as well as detailed informationabout users, connections, and network address translation.The HostWatch display uses the logging settings configuredwith Policy Manager. For instance, to see all deniedincoming Telnet attempts in HostWatch, configure the Fireboxto log incoming denied Telnet attempts.The line connecting the source host and destination host iscolor-coded to display the type of connection being made.These colors can be changed. The defaults are:• Red – The connection is being denied.• Blue – The connection is being proxied.• Green – The connection is using network addresstranslation (NAT).• Black – The connection falls into none of the firstthree categories.Representative icons appear next to the server entries forHTTP, Telnet, SMTP, and FTP.Name resolution might not occur immediately when youfirst start HostWatch. As names are resolved, HostWatchreplaces IP addresses with host or usernames, dependingon the display settings. Some machines might neverresolve and the IP addresses remain in the HostWatch window.To start HostWatch, click the HostWatch icon(shown at left) on the Firebox System Manager.User Guide 97