Intro

ICEWatch Introduction

ICEWatch is designed to watch the attacks recorded against your computer by BlackICE Defender, distributed by Network ICE Corp. BlackICE is a software firewall, which will protect your computer from intrusion attempts through any TCP/IP network connection (such as dial-up Internet connections, xDSL or Cable Modem connections, and so forth).

While BlackICE is powerful and does a great job protecting your computer from network intrusions or attacks, it is somewhat lacking in the information it gives to you about these attacks (though it is improving, especially in v2.1u and above). This is where ICEWatch comes in.

ICEWatch monitors the attack list that BlackICE creates (by default, this is attack-list.csv in the BlackICE install directory). It warns you when new attacks have been recorded, lets you display all the attack data, allows quick sorting by any attack parameter, and makes it simple to copy & paste data from the attacks. This copy/paste facility makes it much easier to report attacks against your computer to the Internet Service Provider (ISP) of the offender.

ICEWatch shows you attack information in the Data Window. You may control sorting and column ordering using the column headings in the Data Window. All other options and controls appear in the various Menu items.

ICEWatch accepts command line switches that modify its default behavior. These switches are:

  • /A – Autostart ICEWatch. This causes ICEWatch to start running as soon as it is launched. Normally, ICEWatch will wait until you issue the Run command before it starts running and monitoring the attack list file for changes.
  • /M – Maximum Drop-Down List Size. This sets the maximum number of files that will be shown in the Preferences Dialog in the File to Monitor drop-down list. The switch must be followed immediately by the size (e.g. "/M8" for a maximum of 8). The value must be at least 1; the default is 10. Note that if you set a value smaller than the actual number of files listed for recall in your ICEWatch.ini file, the extra file names will be deleted from this list (not the files themselves, just their appearance in this list), and not saved or available in future sessions.
  • /N – No Confirmation on Close. This causes ICEWatch to skip the confirmation dialog when you try to exit. The confirmation dialog helps prevent accidently closing ICEWatch. If you find it annoying or unnecessary, use this switch.
  • /T – Tray Icon Always Shown. Normally, the tray icon is only show when ICEWatch is minimized, and "Hide when Minimized" has been specified. This option will always display the tray icon for ICEWatch, no matter if the ICEWatch window is minimized, maximized or hidden.


The Data Window

To sort the display window by any column, simply click that header for that column. The first time you click the column, the data is sorted in increasing order by that column. The next time, it is sorted in decreasing order. If you hold the SHIFT key when you click on columns, a multi-column sort is defined. The primary sort key is the first column you clicked, the secondary key the second column, and so on. If you re-click a column with the shift key held down, the sort order for that column is reversed, but the key order (primary, secondary, etc.) remains unchanged. The data is re-sorted each time you click a column header. To reset the sort to a single column, simply click that column without holding down the shift key.

When you begin sorting by clicking on column headers, the headers will be suffixed with (+1) or (-1) to show ascending or descending sort, primary key. Likewise, the secondary sort column would be suffixed with (+2) or (-2), and so on. The initial sort state when ICEWatch is started is with the Time Stamp column in descending order (-1).

Columns may be resized by clicking on the narrow, right-hand shaded border between the columns and dragging those from side to side. To hide a column completely, drag its border compeltely to the left. ICEWatch remembers the sizes of each column (as well as the window size and position).

Columns may be reordered by dragging the column header to a new position. Just click on the header and drag it to the spot you want, and release the mouse button.

Any time data is visible, you may right-click on any line and a shortcut menu will appear, offering you choices such as Copy and Advice. Please see information on the Edit and Status menus for more information.


Columns

Column Information

There are several columns that are displayed in the ICEWatch window. Most of the columns are displayed by default; you cannot turn them off but you can resize and hide them. To resize a column, click on the right edge of the column header (a resize mouse cursor should appear, which looks like a vertical line with two small horizontal arrows pointing to the left and right). Drag the right side of the column header until the column is the size you want it. To hide it, drag it all the way to the left. To unhide a column, move the mouse cursor to the over the column edges; when you see a double-vertical line for resizing instead of a single one, you are resizing a hidden column.

The column headers also allow you to sort the records simply by clicking on them.

The columns and their default order are:

Time Stamp

The date and time the attack was recorded. Note that if the most recent attack occurs again (by the same user) before any other attack, BlackICE will update the Time Stamp and Attacks counter instead of adding a new record. There are cases where even older records are coalesced together with a newer attack; this happens according to some non-published rules within BlackICE. The attack time is displayed as local time (while the Copy command will show the time as GMT).

Severity

The numeric severity value assigned by BlackICE. Attacks whose severity is less than the Minimum Severity for Alerts (set in the Preferences Dialog) will not cause ICEWatch to initiate an alarm or request acknowledgement from you.

Issue #

The Issue Number is assigned by BlackICE, and isn't terribly useful except in reporting attacks to ISPs. The description (see below) is more useful.

Description

A textual description of the attack.

Attacker's IP

The IP address of the attacker.

Attacker's Machine Name

BlackICE puts in the DNS Name, Computer Name or NetBIOS name, depending on the data it can retrieve during the backtrace on the attack.

Victim's IP

The attacked IP address; this would be your IP address (or one of your IP addresses, if you use several) at the time you were attacked. If you dial-in for Internet access or use more than one ISP, this number may vary.

Port Information

Additional parameters and/or port information from the attack.

Attacks

A count of the number of times this attack was detected.

Attack Result

BlackICE calls these the Severity Icon Response Level Overlays. This feature appeared in BlackICE version 2.1. One of 6 different attack result codes:

  1. Blocked - The attack was blocked successfully.
  2. Unsuccessful - Other defenses on your computer (anti-virus program, the OS, etc.) blocked the attack without any action on the part of BlackICE.
  3. Unknown - BlackICE triggered its protections as soon as the attack was detected, but some packets may have made it through. It is unlikely that the your computer was compromised. BlackICE assigns this result overlay to all older records (pre-version 2.1) in the attack list.
  4. Possible - Similar to Unknown, except in this case some attacking packets definitely made it through. The attack may have compromised your system.
  5. !SUCCESSFUL! - While BlackICE detected abnormal network traffic entering or leaving your computer as the result of the attack, it could not block the attack. The attack has compromised the system.
  6. (not recorded) - This attack does not have any result code associated with it (probably created by a version of BlackICE before 2.1). While BlackICE reports these as "Unknown", ICEWatch differentiates between the actual "Unknown" result code and records for which no code has been recorded.

If ICEWatch encounters a code it does not understand, it will display "?unknown result code?" in the Attack Result column.

Attacker DNS Name

The DNS name of the attacker, if BlackICE was able to find it through a backtrace or DNS search. This is an optional field, which may be selected in the Preferences Dialog . Sorting on this field may be very slow.

MAC Address

MAC stands for Media Access Card, a.k.a. the network adapter. Many computers will tell you the MAC address of their adapter card when asked during a backtrace. If it was available, it is displayed. This is an optional field, which may be selected in the Preferences Dialog . Sorting on this field may be very slow.


Menu

Menus

There are four menu items in ICEWatch: File, Edit, Status and Help. Please see help for each of these menu items for more information.


File Menu

The FILE menu has only one item: Exit. This will close ICEWatch and stop monitoring BlackICE for attack information. This does not stop BlackICE or any of its monitoring or firewall protections. It simply closes ICEWatch.

When you restart ICEWatch and begin monitoring the same attack list file from BlackICE, ICEWatch will show you any new attacks that occured since you last acknowledged an attack.


Edit Menu

The EDIT menu allows you to change what information is viewed, how it is viewed, and to copy information for pasting into other programs. The items on this menu are:

Show All

(shortcut Ctrl-A)
Show all attack records. Normally, ICEWatch will only show new attacks above a minimum severity level (configurable using the Preferences Dialog -- see the Preferences menu item below). Show All allows you to see every attack record, old or new, no matter what its severity. This is a toggle item (meaning it turns Show All on and off). Show All is on if the check mark appears beside it on the menu.

Show Old/New

(shortcut Ctrl-O)
Shows older attack records that are also above the minimum severity level , instead of just showing the new attacks. This lets you see previously acknowledged attacks without showing older and recent attack records that are of lower severity.

Find

(shortcut Ctrl-F)
Brings up the Find Dialog, which allows you to find occurances of a text string in the attack records currently displayed. Searches up or down, case sensitive or insensitive. Note that the F3 key will repeat the find operation (as in Find Next) without recalling the dialog box, but with all the same settings. Searches always begin at the line before or after the first currently highlighted line; if no line is highlighted then the search begins with the first line displayed.

Clear Selection

(shortcut Ctrl-L)
Clears the current selection, if any. You may select records using combinations of the mouse, shift and ctrl keys, and arrow keys, just as you do in most Windows programs. Clear Selection simply clears the current selection for you.

Copy

(shortcut Ctrl-C)
Available when one or more records are selected. It copies a nicely formatted report on the selected attacks, suitable for pasting into e-mail messages to the offender's ISP. This command is also available via a right-click shortcut menu.

Copy IP Address

(shortcut Ctrl-I)
Available only when a single record is selected. It copies the attacker's IP address to the clipboard, making it easy to paste that IP address into other programs (such as SamSpade or the SpamCop Host Tracker) that will help you find out the e-mail address for complaints against attacks by that user. This command is also available via a right-click shortcut menu. Also see the Host Track option on the Status menu.

Copy DNS Name

(shortcut Ctrl-D)
Available only when a single record is selected. It copies the attacker's DNS name (if known) to the clipboard. This command is also available via a right-click shortcut menu.

Preferences

Brings up the Preferences Dialog, allowing you to configure various options in ICEWatch. This dialog is not available while ICEWatch is running.


Preferences Dialog

Accessed via the Preferences item on the Edit Menu An example of the dialog follows below:

File to Monitor

This is the name of the file ICEWatch will monitor; this should be the Attack-List.CSV file in your BlackICE program directory (typically that is C:/Program Files/Network ICE/BlackICE). You may type a file and path name in the edit field, or use the Browse button to browse around and find it. ICEWatch will not work correctly (and may crash) if you try to monitor a file that is not a proper BlackICE attack list.

The combo box keeps track of the last several files you monitored; this is saved across sessions. The actual number of files that the drop-down list will hold is controlled by the /M command line switch. The list makes it easier to keep tabs on BlackICE attack logs on other machines across the network. Because ICEWatch remembers when you last viewed each attack list file, it will quickly show you any unacknowledged attacks (note that acknowledgement and severity levels for attacks are based on when you last viewed the attack list file from this computer and your Preferences settings). There is no problem running ICEWatch on several machines against the same attack list file(s); you cannot, however, clear the attack list from BlackICE until all the copies of ICEWatch have either exited or stopped monitoring that file.

Play Sound on File Event

If the checkbox is checked, then the sound file listed will be played when an attack is detected by BlackICE (provided that it is at or above the Minimum Severity Level. To hear what the audio file sounds like, press the PLAY button. To browse for a different audio file, press the BROWSE button.

The Silent Operation checkbox and the time ranges that follow it allow you to select a period during the day to surpress the audio alarm. In the example above, the .WAV file will not be played for any attacks that come in between the hours of 11:55 PM and 6:30AM, inclusive. This is useful if you sleep within hearing distance of the computer. Note that this only supresses playing the .WAV file; all other actions that occur after an attack will still occur (e.g. maximize or running a program).

Run Program on File Change

If the checkbox is checked, then the executable file listed will be run when an attack is detected by BlackICE (provided that it is at or above the Minimum Severity Level). The file may be a document, a web page, or anything else that you could start from the RUN command on the Windows Start menu. Note that if another attack occurs before this program has finished running, ICEWatch will not start another instance of the program (this is to prevent multiple attacks from firing off several instances of the program). To browse for a differet file, press the BROWSE button.

Display Options

These options control how ICEWatch behaves as it is running. They are:

  • Minimize on Start: Minimizes the ICEWatch window when monitoring is started with the Run command (or from the command line with the Autostart option).
  • Hide When Minimized: Hides the ICEWatch window and puts an icon in the tray when ICEWatch is minimized (instead of leaving it on the Windows task bar). If "/T" was specified on the command line of ICEWatch, then the icon will always be on the tray, regardless of the hide or minimized state.
  • Maximize When File Changes: Restore (not really maximize) the ICEWatch window (if it was minimized and/or hidden) when an attack is detected.
  • Show DNS Name: DNS Name is one of the optional display columns. It is optional because it is not available in the attack list file, but instead must be found in special BlackICE data files. It is therefore slower to display and can be very slow if you use it as a sort column.
  • Show MAC Address: MAC Address is one of the optional display columns. It is optional because it is not available in the attack list file, but instead must be found in special BlackICE data files. It is therefore slower to display and can be very slow if you use it as a sort column.
  • Minimum Severity for Alerts: The minimum value for the Attack Severity Level to trigger an alert. Any attacks below this level will not cause an alert to be triggered. These attacks will not even appear in the ICEWatch window, unless you have selected Show All. A value of zero (0) shows all attacks. A value of -1 will suppress all attacks (but then what would be the point of running ICEWatch?). A good value to use is 50. Changing this value may change the list of records displayed if Show All is not in effect.

    • Accepting or Cancelling Changes

    To accept and use the settings in the Preferences Dialog, press/click the OK button at the bottom. To cancel and keep the previous settings, press/click the CANCEL button.


Status Menu

Stop

(shortcut Ctrl-S)
Available only when ICEWatch is running (or monitoring) the attack list. This does not close ICEWatch, it simply stops monitoring until you run monitoring again. By default, ICEWatch comes up in "stop mode." The command line switch "/A" may be used to bring ICEWatch up in "run mode." You may only set Preferences when ICEWatch is in "stop mode."

Run

(shortcut Ctrl-R)
Available only when ICEWatch is in "stop mode". Running refers to the monitoring process; when in "run mode", ICEWatch monitors the BlackICE attack list file, looking for new attacks against your computer. The default when ICEWatch is started is "stop mode", but you may override this with the command line switch "/A."

Acknowledge

(shortcut Ctrl-K)
Available only when a new attack has occured (and the words "NEW ATTACK RECORDED" appear in the titlebar). This is how you let ICEWatch know that you have seen this new attack. When a new attack occurs, ICEWatch will take those actions specified in the Preferences Dialog. If you exit ICEWatch without acknowledging an attack, that attack data (along with any newer attacks) will reappear the next time you start ICEWatch.

Reset List

This simply clears out any currently displayed records (as long as Show All is not in effect). Useful when you have several older attacks being displayed, and you want to start fresh. This will also clear any pending Acknowledge requests. Show Old/New will allow you to see these and all older attack records later, if you wish.

Advice

(shortcut Ctrl-E)
Available only when a single record is selected. This performs the same function as the "Advice" button in BlackICE. It will send you out to the Network ICE Advice site on the Internet, showing you information specific to the attack that is selected in the ICEWatch window. This command is also available via a right-click shortcut menu.

Host Track

(shortcut Ctrl-T)
Available only when a single record is selected. This sends the Attacker's IP Address out to the SpamCop Host Tracker web page. This will give you an e-mail address that the attacker's ISP has designated for abuse reports. This command is also available via a right-click shortcut menu.


Help Menu

Shows this help file, and a Help About box with version information.


Tray

Tray Icon

ICEWatch will place an icon in the taskbar tray in two cases. First, if ICEWatch is configured to be hidden when the window is minimized. Second, if ICEWatch was launced with the "/T" switch; in this case, the tray icon is always visible, without regard to whether or not the window is hidden or minimized. Here is what the tray icon looks like:

Whenever the tray icon is visible, you may double click it to switch to the ICEWatch window. You may also right-click the icon, and a menu with two options will appear. The first is Open; this has the same effect as double-clicking the icon. The second is Exit; this has the same effect as Exit menu item.


FAQ

Frequently Asked Questions

  1. Why can't I clear BlackICE attack records when ICEWatch is running?

    2. ICEWatch keeps the BlackICE attack list file open when it is running. If you want to clear the attack list records, you must either exit ICEWatch, or stop monitoring the attack file. Note that if another computer on your network is monitoring your attack list file, you will not be able to clear the records until that computer either stops running ICEWatch or stops monitoring your file.

  2. I changed (or "touched") the attack list file, but nothing was reported. Why?

    3. Starting with version 2, ICEWatch looks into the attack list file whenever a change (or touch) is detected. Unless the data has actually changed, nothing will be reported. The items ICEWatch looks at are: Record Count, Timestamp, Severity, Attack Count, Port Information.

    The Record Count (as in how many attack records are in the monitored file) is used to determine if any new records have been added; if there are no new records, nothing is reported. Note that BlackICE will sometimes coalesce older records with a new attack, so it is possible for the record count to not change (or decrease) when a new attack is reported. ICEWatch accounts for this. ICEWatch does not display the record count; it is only used internally.

    The Timestamp value is compared to the last known attack timestamp. If it is not later than the last known attack, the record is ignored (unless Show All or Show Old/New is currently set).

    The Severity of the attack must be greater than or equal to the Mimumum Severity value as set in the Preferences Dialog. If it is not, then the attack record will not be shown unless Show All is currently set.

    The Attack Count is used to determine if the most recent record is being used to coalesce multiple attacks from the same attacker.

    The Port Information is used to determine which TCP and/or UDP port or ports the attacker attempted to access. BlackICE will often coalesce attacks on multiple ports from the same attacker into a single record, even if those attacks occured minutes (sometimes even days) apart. ICEWatch checks the port information for changes in order to detect coalesced attack records.

  3. Why aren't all the attacks shown in the BlackICE window also shown in the ICEWatch window?

    4. The Severity of the attack must be greater than or equal to the Mimumum Severity value as set in the Preferences Dialog. If it is not, then the attack record will not be shown unless Show All is currently set. Furthermore, older attacks (those that occured at or before the last acknowledged attack) will not be shown unless Show All or Show Old/New is set.

  4. ICEWatch says there is a new attack, so why I don't see a record displayed that matches the time and date of the attack?

    5. There are two possible reasons. Either you were using Show All and turned that off after the attack occured, or you increased the Minimum Severity value after the attack occured. The simplest way to see the particular record is to turn Show All back on. Don't forget to acknowledge the attack once you are through reviewing the record(s).

  5. Why does the tray icon disappear when I double-click on it?

    6. The default behavior for the tray icon is to remove itself from the tray when ICEWatch is not hidden, and double clicking on the icon unhides the ICEWatch window. You may control the hiding (or not) of ICEWatch's window from the Preferences Dialog.

    If you would prefer that the tray icon always be visible, you should start ICEWatch with the "/T" switch.


Update Log

Updates & Changes to ICEWatch

Version 2.19 – 12 February 2001

  • Fixed a bug in the drop-down list code introduced in version 2.17. This bug could corrupt the local memory arena if the list of files grew close to the limit. Also fixed a bug where opening an unavailable file could lead to a crash.

    • Version 2.18 – 26 November 2000

  • If an exit/close program operation is canceled (using the confirmation dialog added in version 2.16), then ICEWatch is instead minimized as per its minimize settings in the Preferences dialog.

    • Version 2.17 – 11 November 2000

  • Added drop-down combo box list to the Preferences Dialog for the file to monitor. This tracks the last nattack files you have monitored (where n is set by the /M command line switch) . It is very useful for monitoring the attack lists on several machines (each running BlackICE) across the network.
  • Reorganized help file's Table of Contents.

    • Version 2.16 – 28 October 2000

  • Added a confirmation dialog to the exit procedure to prevent accidental closure of ICEWatch. Also added /N switch (no confirm) to override this. For those who really want to know, sending WM_CLOSE with wParam = 0x7D00 will bypass the confirmation dialog (sending WM_ENDSESSION with wParam != 0 has the same net effect). By default, WM_CLOSE is sent with wParam = 0.
  • Fixed a bug in WriteListViewColInfo() that allowed the sort indicator to be written out with the column name. Net result was order and width information on sort columns was lost. Please note: you may loose your existing column order and width information the first time you run this new version of ICEWatch; this will only happen the first time you run v2.16.

    • Version 2.15 – 12 October 2000

  • Added command line switch processing. While "start" will still be accepted for Autostarting (if it is the only non-switch token the command line), we now support: /A (autostart), /T (always show the tray icon). Please change your calls to ICEWatch to use on the command line /A in lieu of "start".
  • Fixed some broken links in the help file index.
  • Previous assertions in the FAQ notwithstanding, in previous versions of ICEWatch, you had to exit ICEWatch before you could clear the BlackICE attack list. Now you need only stop running / monitoring the attack list in order to clear it with BlackICE.

    • Version 2.14 – 11 September 2000

  • Added Show Old/Severe to Edit menu. Shows older attacks that also pass the current minimum severity test.
  • Made changes to the Minimum Severity Level in the Preferences Dialog take effect as soon as the dialog is closed, instead of waiting until monitoring is restarted (or some other "significant change" occured).
  • Cleaned up code in rarely (if ever) executed error handling sections. Also improved how dialogs are centered on the screen (only difference you will notice is if a dialog was larger than your display).

    • Version 2.13 – 8 September 2000

  • Added Silent Times to the Preferences Dialog. This lets you choose a time span during which the alert sound will not play. Useful if you (or others) sleep near the monitored computer.
  • Free the thread handle for the monitoring thread when the thread exits (wasn't freed previously, resulting in a small memory "leak" that was not cleaned up until ICEWatch was closed).

    • Version 2.12 – 2 September 2000

  • Fixed a bug in how ICEWatch.ini files with no timestamps recorded are interpreted. Without this fix, attack records could not be seen (happened most often with a new or cleared attack-list.csv file). Thanks to Tony for this report.
  • BlackICE v2.1cn seems more aggressive in its coalescing of attack records (or else I just never saw this sort of coalescing before). To catch these cases, added port info to the list of columns checked (also checks atacker IP address and issue number), and thanks again Tony.

    • Version 2.11 – 25 August 2000

  • Fixed a bug in the Preferences Dialog was ignoring changes to the Run Program section. Thanks to Jac for the report.

    • Version 2.10 – 10 August 2000

  • Initial public release on Robin Kier's website. Thanks to Robin for giving me access to the original ICEWatch source code and for helping test out this release!