This article applies to:

• Firewall Suite 4.1x

Question:

• How do I add additional protocol families to my firewall reports?
• How do I edit the wtprotocols.txt file to add additional protocol families to reports?

Symptoms:

• Large numbers of "other" protocols appear in the firewall report.

Procedure:

By default, Firewall Suite will only display five pre-defined protocol families. These are: Web, E-mail, FTP, Telnet, and RealAudio.  Within the defined protocol families, Firewall Suite is configured to handle a certain number of common protocols.  If you have either protocols or protocol families that are not included by default, it is possible to add additional protocols and protocol families to your Firewall Suite reports.  

To add additional protocols to the pre-defined protocol families, follow these steps:

1. Select Options | General Firewall Activity | Protocols | New.

2. In the New Protocol Dialog box, define the protocol appearing in the log and associate it with a Protocol Family. 

   Note: This change will only affect subsequent reports. To apply to previous reports, the FastTrends database must be deleted and log files re-analyzed.

To add additional protocol families, follow these steps:

1. It is necessary to edit a text file in the root of the Firewall Suite folder called WTProtocols.txt. Open this file with a text editor (such as Notepad).

2. At the bottom of this file, add a line with the name of the new protocol family encased in brackets. For example:

   [newprotocolfamily]

3. Save the WTProtocols.txt file.

4. After adding the new protocol family to the WTProtocols.txt file, exit and unload the Firewall Suite program, and then reload.

5. If you wish to associate protocols in your log file with the newly created Protocol Family, follow the procedures outlined in the first set of steps above.

Notes:

The best way to find out what protocols make up the "other" category in the report is to run a General Firewall Activity report, and review the Top Incoming/Outgoing Protocols Usage reports.

This article was previously published as:

NETIQKB10309