How do I filter for a specific protocol found in my firewall log files?

This article applies to:

• Firewall Suite 4.1a

Question:

Symptoms:

• Only protocol families are available for filtering, but I need to filter a specific protocol.

Causes:

Protocols from your log files are associated with or assigned to a type of traffic in the 'Protocols' dialog box for reports. Protocols not included in the 'Protocol in Log File' list and those that are not associated with a 'Type of Traffic', are reported as 'other'. The activity of unassociated protocols grouped as other is difficult to analyze.

Firewall Suite by default only allows you to filter a "type of protocol", also called "protocol family".  To filter a specific protocol, you must first create a new protocol family with the one protocol you want filter. 

Procedure:

1. Open the WTProtocols.txt file located in the Firewall Suite installation directory.

2. Add a custom protocol family by creating a new section within the text file.  For example, to create a new protocol family called Filter1 with a protocol name of http/Test, specify the following syntax at the bottom of the file.

   [Filter1]
http/Test

3. If Firewall Suite is running, select Exit and Unload found in the File menu to close the program. This will allow for the changes to take effect.

4. You may now either edit an existing profile or create a new profile, and this protocol will now be available for you to select as a filter.

You can also create the new protocol family and add the single protocol you want to filter via the Firewall Suite interface. 

1. Create the protocol family in the WTprotocols.txt.

2. Click Tools | Options.

3. Select Protocols from the General Firewall Activity branch.

4. Click New.

5. Type the protocol as it appears in the log file in the Protocol appearing in log text box.

6. Select the new protocol family you just created from the Protocol Family drop-down menu.

7. Click OK to close out of the New Protocol dialog.

8. Click OK to close out of the Options dialog.

9. Create a new profile or edit an existing profile, and use the protocol family filter, selecting the newly created protocol family.

This article was previously published as:

NETIQKB11883