Информатика и выч. техника \ Информационные системы и сети

Installing Iris. Using Iris to Monitor Network Activity. Decoding and Reconstructing Captured Data

Страницы работы

97 страниц (Word-файл)

Скачать файл

Фрагмент текста работы

Note that running active scripts can be represent a security risk.
Decode UDP Datagrams	Indicate if you want Iris to show the content of UDP datagrams in Decode Mode.
Scroll sessions list to ensure last session visible	Iris will scroll the Sessions list. This ensures that the most recent data is shown in the packet capture window.
Use Address Book	Iris will use -+

Adapters

Lists all installed adapters. See “Installing Iris” for more information about supported Ethernet cards.

To change an adapter,

• Click the adapter.

• Click OK (you don’t need to click Apply).

Adapters can be changed even while capturing.

Note: RAS adapters are not supported under Windows 2000/NT/XP.

They are supported on Windows 9x/Me.

Guard

Option	Description
Enable alarm sound	Iris will play an audio alarm when a connection attempt is detected.
Play this wave file	Audio file that will be played instead of the default sound.
Log to file	File where connection attempts will be saved.
Ignore all local connections	Iris will use current IP address and network mask to determine if an address is from the local network or if it is from an external host. If this option is checked, Iris will not take into consideration connection attempts initiated by local hosts.
Ignore connections on these ports	Iris will ignore connection attempts seen on a port from the allowed ports list.
Use software filter	If this is checked, Iris will apply filter rules to connection attempts. If this is cleared, Guard will notify all connection attempts (which are not filtered by the allowed port list) regardless of the applied software filter. This option allows the Guard module to function independently of the current filter. However, using the filter gives you the option to watch connection attempts only on specific hosts. In both cases, the Ignore connections on these ports option will be in effect.
	Note: Even if Use software filter is checked, a filter will be applied only if Apply filter to incoming packets is ON.

Miscellaneous

Option	Description
Packet buffer size	Number of packets that the internal buffer can hold.
Stop when free disk space drops bellow	Allows you to set a break-off point for packet logging. Iris will stop logging packets when disk space gets very low. This stops a denial of service (DoS) attack aimed to fill the hard disk of the system that Iris is running on. Note: If Decode module is enabled, Iris will also create temporary files using disk space from the partition where it is installed. These temporary files are deleted when New Capturing Session is selected or when Iris exits.
Enable CPU overload protection	Iris will not display packets when the CPU usage is at 100% for more than 4 seconds. As soon as CPU usage is less than 100%, Iris will start displaying packets again. For advanced users:
	To customize "CPU Overload Protection" add the following entries to the registry and modify their values: [HKEY_CURRENT_USER\SOFTWARE\eE ye Digital Security\Iris\CPU_Usage] "CPU_load_threshold"=dword:00000064 "Seconds_load_threshold"=dword:0000000 4 Description: CPU_load_threshold means the CPU usage percentage from which Iris starts counting seconds Seconds_load_threshold is the number of overload seconds after which Iris starts reducing its processing.
Start automatically with Windows	Starts Iris automatically when Windows starts, allowing a packet-log to occur as soon as possible.
Check for updates when program starts	If checked, Iris will check if a new version is available and will display What’s new in the latest version. System has to be connected to Internet for Update to work..