WatchGuard Firebox System 4.6 User Guide

HostWatch• Red – The connection is being denied.• Blue – The connection is being proxied.• Green – The connection is using network address translation (NAT).• Black – The connection falls into none of the first three categories.Representative icons appear next to the server entries for HTTP, Telnet, SMTP, andFTP.Name resolution might not occur immediately when you first start HostWatch. Asnames are resolved, HostWatch replaces IP addresses with host or usernames,depending on the display settings. Some machines might never resolve, and the IPaddresses remain in the HostWatch window.To start HostWatch, click the HostWatch icon (shown at left) on theControl Center QuickGuide.HostWatch displayThe upper pane is split into two sides, Inside and Outside. Double-click an item oneither side to produce a pop-up window displaying detailed information aboutcurrent connections for the item. The Connects For window displays the IPaddresses, port number, connection type, direction, and other detailed informationabout these connections.The lower pane displays detailed information for connections directly related to theFirebox. Double-click a connection to view details regarding a specific host.Connecting to a FireboxFrom HostWatch:1 Select File => Connect.You can also click the Firebox icon.2 Use the Firebox drop list to select a Firebox.You can also type the Firebox name or IP address.3 Enter the Firebox read-only password. Click OK.HostWatch connects to the Firebox and begins the real-time display.Replaying a log fileYou can replay a log file in HostWatch in order to troubleshoot and retrace asuspected break-in. From HostWatch:1 Select File => Open.You can also click the Folder icon. The Open dialog box appears.2 Browse to locate and select the Logdb file.By default, log files are stored in the WatchGuard installation directory at C:\ProgramFiles\WatchGuard\logs. HostWatch loads the log file and begins to replay the activity.3 To pause the display, click Pause.4 To restart the display, click Continue.5 To step through the display one entry at a time, click Pause. Click the right arrowto step forward through the log. Click the left arrow to step backward through thelog.User Guide 99