Watchguard Firebox X20E, Руководство пользователя

Страница: 43 / 310

User Guide 31
Monitoring the Firebox X Edge
Mask
If a netmask is associated with the entry, it is listed here. If not, an asterisk (*) is shown.
Device
Interface on the Edge where the hardware address for that IP address was found. The Linux
kernel name for the interface is shown in parentheses.
Authentications
This status page shows the IP address, user name, start time, and idle time for every user that is cur-
rently authenticated to the Edge.
Connections
This status page shows all TCP/IP connections that go through the Edge. It is divided between proxy fil-
ters and packet filters. The packet filter list is sorted by protocol, with TCP protocols at the top of the
list, then UDP connections, then other IP protocols. In TCP/UDP protocols, it is sorted by timeout val-
ues.
The proxy filter connections show:
Type
HTTP, FTP, SMTP, or POP3.
Source: Port
IP address of the computer that sent the packet and the port used to send the packet.
Destination: Port
IP address the packet is being sent to, and the port.
Action
- POP3 shows "n/a"
- HTTP shows the type of request, such as GET or POST. It also shows a hyperlink to the
destination web page.
- FTP shows the last FTP command the user issued, such as LIST, CWD, or GET.
The packet filtered connections show:
Protocol
Protocol that the connections uses.
Dir
Direction of the connection: incoming or outgoing.
Source: Port
Source IP address and port. A green arrow shows the direction of the connection.
Destination: Port
Destination IP address and port.
State
State of the connection. For TCP it is:
- TIME_WAIT - waiting for the TCP socket to close
- CLOSE - closing the socket
- ESTABLISHED - active connection
- SYN_SENT - establishing connection
UDP is a stateless protocol. For UDP, the connection shows as:
- REPLIED - there have been packets sent in both directions
- UNREPLIED - packets have been sent in only one direction
Other protocols are shown as "n/a".