Help for McAfee Firewall

 Introduction

 Install/unInstall [image]           [image] Before you reinstall Windows

 Configuration

 Application Settings and Display

 System Settings and Display

 What is "Unknown Traffic"?

 Logging

 Reference

 Glossary

 Advanced Topics

 This picture indicates comments directed at the highly security-conscious.

 This picture indicates comments that remind you not to worry.


 Introduction

About McAfee Firewall

How is my PC at risk on the Internet?

How will McAfee Firewall help me?

What other protection do I need?

Technical:

Are there any data packets that McAfee Firewall cannot stop?

What network devices does McAfee Firewall support?

What protocols can McAfee Firewall filter?

 How can I still be harassed, even with McAfee Firewall?


 Install/unInstall

Why do I need Winsock 2?

How am I protected after installation?

When should I run McAfee Firewall?

Is the demo version the same as the registered version?

How do I uninstall (remove) McAfee Firewall?

When do I choose "Uninstall CPD's Network Component"?

Can I reinstall for another trial period?


Configuration

Applications:

How does McAfee Firewall control applications?

What are the default settings for applications?

System:

How does McAfee Firewall control System activity?

What are the default settings for System activity?

How to check if your devices are shared

Using with PPP over Ethernet (PPPoE)

Configuration File:

Password Protection

Instructions for Administrators:

Configure Network, Display and Logging Controls

Configure Applications

Configure System Settings

Reset System Settings after adding or removing network devices

Use Password Protection


Application Settings and Display

What are the default settings for applications?

What happens if I choose "Trust All Applications"?

What happens if I don't choose "Trust All Applications"?

How do I monitor an application's network activity?

How do I detect trojans, such as BO, NetBus?

See Also

Configuring Applications


System Settings and Display

What are the default settings for System activity?

How is System traffic treated differently than application traffic?

NetBIOS over TCP settings

Identification settings

ICMP settings

ARP settings

DHCP settings

RIP settings

PPTP settings

Other IP protocol settings

Non-IP protocol settings

WINS

System-generated DNS

See Also

Configuring System Settings


 Logging

McAfee Firewall logs network traffic either by the connections that applications make or according to System Settings. Also, unexpected traffic is logged, in case it is required to find a hacker.

The "Activity Log" is a record of the connections made by applications. It does not include system traffic. The display is limited to the last 100 entries and older ones are removed as new ones are added. All these entries are written to the log file. The log file is stored in the install directory (by default: C:\Program Files\Signal9\McAfee Firewall). It is named using a date stamp, e.g. 199901.log for logs during January, 1999. You can have it write the log file in a different directory, if you choose.

The log file is limited to 5 MB, but this may fill up quickly, depending on your network activity. You may want to adjust the limit, copy these files to backup or remove them periodically. Once the 5 MB limit is reached, application traffic and "Unknown Traffic" is not logged. System traffic (as set in System Settings) is still logged. You can change the log file size limit, if you choose.

If network traffic is very high, with data packets arriving or going faster than your system can log them, then not all data packets are logged.

Click here for a detailed description of the log file messages.

See Also

Activity Log Subtree, Log File: Setting the Path and Size, Log File Messages, Logging Option, System Settings


About McAfee Firewall

McAfee Firewall is a personal firewall that lets you monitor, control and log your PC's network activity.  It will help protect you from Internet hackers and keep your PC private.

McAfee Firewall can:

•  stop fileshare and printshare access attempts (remember to check your device sharing in Windows too),

•  show who is connecting (if you allow sharing),

•  stop floods and other attack packets from being received by the Operating System,

•  block untrusted applications from communicating over the network,

•  help you detect hidden programs ("trojans") that can give remote access to your PC or reveal private information (e.g. online banking information),

•  give you detailed information about which sites you have contacted and the type of connection that was made, and

•  let you block all traffic while you are away, if your PC is connected 24 hours a day

Network protection is different from other forms of protection, such as:

•  anti-virus programs - you still need them,

•  logon screens and screen saver passwords,

•  file encryption or encrypting file systems,

•  boot-time passwords,

•  physical access to the computer, e.g. stealing the hard drive

And for the truly curious, information can be broadcast from your system through electromagnetic radiation (no, it isn't giving you cancer) and through the power cord, so security is never absolute.

 And if that makes you more curious, when you delete a file, the data is still on disk. It is just the filename that is deleted by doing this. Eventually, the data will get overwritten. Overwriting once, however, does not destroy the information absolutely. To truly destroy the original information, you must overwrite it many times with varying information.


How is my PC at risk on the Internet?

When you connect to the Internet, you share a network with millions of people from around the world. While that is a truly wonderful and amazing accomplishment, it brings with it all the problems of being accessible to complete strangers.

Imagine 1000 strangers walking in front of your house. Most would be very kind and considerate.  Some, however, would pull the flowers from your garden. Someone else would kick your cat. Another would try to break into your house. You need to lock your house .. with the cat inside.

When on the Internet, you need to lock down your PC. When you talk to strangers on IRC (Internet Relay Chat), be cautious of files they send you. This is one way the BO (Back Orifice) program spreads, giving people remote control of your PC. Check files you get for viruses. Beware geeks bearing GIFs.

When on the Internet, others can try to access your fileshares. You should check that they are not available, or else people can read and delete what is on your system.

 The data you send can be seen by more people than just the intended receiver. Practically any system that is connected to any part of the network path used to relay your data packets can see what is sent. Also, it is hard to know with absolute certainty that you are talking to whom you think you are talking to.


How will McAfee Firewall help me?

McAfee Firewall protects your PC at the network level. It acts as a gatekeeper, checking every data packet going in or out of your PC. It allows only what you tell it to allow.

McAfee Firewall has been designed to be easy to use, while providing you with excellent protection. Once you install and run it, it is configured to block known attacks and to ask you before allowing applications to communicate.

See Also

About McAfee Firewall


What other protection do I need?

McAfee Firewall provides network level protection. Other important types of protection are:

•  anti-virus programs for application-level protection - you still need them,

•  logon screens and screen saver passwords to prevent unauthorized access,

•  file encryption or encrypting file systems to keep information secret,

•  intrusion detection for an added level of network protection,

•  boot-time passwords to stop someone else from starting your PC, and

•  physical access to the computer, e.g. stealing the hard drive

A separate but also important issue is controlling access to information, misinformation and "filth" that is widely available on the Internet. A number of content-filtering programs or services exit that can filter the contents of data packets or restrict access to certain sites.


Are there any data packets that McAfee Firewall cannot stop?

Inbound Data: No.

As long as McAfee Firewall supports a network device and is running, it is intercepting all incoming packets and will allow or block according to the way you have it configured. If you choose to block everything, it will.

Outbound Data: Yes and no.

McAfee Firewall intercepts outbound data packets as they are passed to the network device driver. All popular applications communicate this way. A malicious program could communicate by other means, however.


Why do I need Winsock 2?

McAfee Firewall uses an API (Application Programming Interface) that is not supported by versions of Winsock prior to v2.0. The upgrade is free and is available from http://www.microsoft.com as well as other places.

McAfee Firewall checks for the presence of Winsock 2 during the installation procedure and will inform the user if the system does not have it.  Winsock 2 must be installed before the McAfee Firewall installation can be completed.


When should I run McAfee Firewall?

We recommend that you run McAfee Firewall whenever your PC is connected to a network, whether it is an internal LAN (local area network) or the Internet.

See Also

How will McAfee Firewall help me?


Is the demo version the same as the registered version?

Yes.

When you purchase, you get a license that allows you to continue using the product.


How do I uninstall (remove) McAfee Firewall?

To uninstall McAfee Firewall, choose the "UnInstall CPD" item in the program folder or double-click the icon in the program's installation directory. It is not necessary to choose "Uninstall CPD's Network Component" first, but there is no harm in doing so. The network component is uninstalled as part of the normal uninstall procedure (explained here).

DO NOT use the Control Panel's Add/Remove Programs option. It will not uninstall properly and may leave your system misconfigured.


Can I reinstall for another trial period?

No.

We ask that you evaluate the product within the trial period to decide if you would like to buy it.


What are the default settings for System activity?

NetBIOS over TCP: Blocked.

This will block all fileshare activity over TCP as well as UDP broadcasts. Your system will not appear in anyone's "Network Neighborhood" and theirs will not appear in yours. If your system is configured to support NetBIOS over other protocols, such as IPX or NetBEUI, then filesharing may be allowed if "non-IP protocols" are allowed (see "Other Protocols" below).

Identification: Allowed.

This service is often required when getting email and is required by most IRC servers.

ICMP: Blocked.

This protocol is often abused as a method of breaking people's network connections (especially on IRC).

ARP: Allowed.

ARP is a necessary Ethernet protocol and is not known to be a threat.

DHCP: Allowed if your system uses DHCP.

The program looks in your system Registry to see if one of your network devices uses DHCP. If so, then DHCP is allowed for all devices. If not, then it is blocked for all devices. If you have more than one network device and one uses DHCP, you should check the DHCP setting for each device and allow only for the device that uses (most often cable or ADSL modems and some internal networks, not for dial-up).

RIP: Blocked.

Allow RIP if your adminstrator or ISP advises you to.

PPTP: Blocked.

This should only be altered by the administrator.

Other Protocols: Blocked.

If you are on an IPX network, you should allow "non-IP protocols". If you use PPTP, you should allow "other IP protocols". Ask your network administrator before making any change here.

See Also

ARP, DHCP, ICMP, Identification, NetBIOS over TCP, RIP, PPTP


What are the default settings for applications?

When installed, the default setting is to prompt the user before allowing an application to communicate. The first time you run an application that uses the network, you will be prompted like this:

If you choose "Yes", the application will be allowed to communicate normally, as it would without McAfee Firewall running.

If you choose "No", the application will be blocked and will probably report an error message, such as "Network is unavailable".

If you allow an application the first time you are prompted, you may change this and block it at any time: just select the Settings/Applications menu item. There, you can move applications into either the "Trusted" list or the "Blocked" list.

When you exit McAfee Firewall, your settings are saved and will be the same the next time it is run.

See Also

Application Settings


 How does McAfee Firewall control System activity?

The operating system performs many types of network communication without reporting directly to the user.  McAfee Firewall lets the user allow or block different system functions explicitly.  Settings may be different for each network device, since a PC may, for example, be on an internal network as well as having a dial-up connection to the Internet.

To control System settings, click on the Settings menu item and choose System . Then, choose the network device you want to configure.

You can either double-click on the network device or click once and choose Properties.

You can then choose to allow or block NetBIOS over TCP, Identification, ICMP, ARP, DHCP, RIP, PPTP and other protocols (IP and non-IP).

Does your PC use other system protocols? Let us know at cpd@signal9.com

See Also

ARP, DHCP, ICMP, Identification, NetBIOS over TCP, Non-IP Protocols, Other IP Protocols, RIP, PPTP, System Settings


 How does McAfee Firewall control applications?

McAfee Firewall monitors network traffic to see which applications are communicating. Depending on your settings, it will allow or block an application's attempt to communicate.

To control which applications may communicate, click the Settings menu item and choose Applications :

If you choose to "Trust all applications" (putting a check mark in the box), then  applications will be added to the "Trusted" list automatically and will be allowed to communicate.

If you do not choose to "Trust all applications", as shown in the figure above, then the first time you run an application and it tries to communicate, you will be prompted and asked if you want that application to communicate. You are only prompted once. Known applications are either allowed or blocked, depending on which list they have been put in.

 You can see in the diagram above that the BO "trojan" program was run and put in the blocked list. It appears as " .EXE", that is, a space followed by ".EXE".

See Also

Application Settings


What happens if I choose "Trust All Applications"?

If you choose "Trust All Applications", all networking applications will automatically be allowed to communicate. You will not be asked whether to allow them or not. Their names will be added to the list of allowed applications.

If you suspect that a "trojan" program such as BO or NetBus is on your system, check the list of allowed and blocked applications. BO appears as " .EXE" and NetBus appears as "SysEdit.EXE" in its version 1.53 and as "PATCH.EXE", in its version 1.6 and 1.7.

See Also

Application Settings


What happens if I don`t choose "Trust All Applications"?
What happens if I don't choose "Trust All Applications"?

If you don't choose "Trust All Applications", then the first time you run an application that uses the network, you will be prompted to allow it or not. If you choose to allow it, the application will be allowed to communicate normally, as it would without McAfee Firewall running. If you choose not to allow it, the application will be blocked and will probably report an error message, such as "Network is unavailable".

See Also

Application Settings


How do I monitor an application`s network activity?
How do I monitor an application's network activity?

While an application is running, it is listed in the Activity Tree. Look under My Computer/Applications.  When you highlight an application on the left, its network activity is listed on the right (if you have chosen Detailed Display mode, not Summary).

Another place to look is under the Current Activity entry. When highlighted on the left, all your applications' current network activity is listed.

You can go to Activity Log to see a recent history of network activity. Previous connections are listed on the right. This list is limited to 100 entries. The on-line log file, found in the program's installation directory (c:\Program Files\Signal9\Private Desktop, by default) will have a complete history.

See Also

Activity Log, Applications Subtree, Current Activity, Display, Logging


How do I detect trojans, such as BO and NetBus?
How do I detect trojans, such as BO, NetBus?

Step 1: don't choose the Application setting "Trust all applications". Without having it selected, these trojans cannot access the network without you being asked whether or not to allow them.

Step 2: check all applications in the "Trusted" list and make sure they are names you recognize, use and trust.

BO and NetBus are really just ordinary applications. The threat is that they are designed to install and  run on your system against your will. If you accidentally allow one of these to install on your system, they will be run. When they run, McAfee Firewall will ask you whether you want to allow them to communicate. You should say "No". If you choose "Yes", don't panic, it is not too late. Click on the Settings/Applications menu item and move it from the "Trusted" to "Blocked" list.

BO runs using a file name " .EXE". NetBus version 1.5 ran using a file name "SysEdit.EXE" and v1.6 and v1.7 use the name "PATCH.EXE", but can easily be renamed.

BO listens on UDP port 31337 by default, but in the future, the program may be modified to listen on a different port. NetBus uses TCP ports 12345 and 12346 but may also be modified to use different ports.

Removal of BO and NetBus

It is not hard to remove the current versions of BO and NetBus. There are many programs for detection and removal available on the Internet which are 100% effective and free. Signal 9 has used "BO-detect" successfully. Many anti-virus software packages have been updated to detect and remove them.

McAfee Firewall can be used to remove them. If it is running on your PC, it will be listed in the Applications subtree. Right-mouse click on any application and there is a menu option to see the directory path to the executable. Find where the trojan is and delete it.

Removal of other trojans

To find and remove an unknown program here are two approches:

1) When you are prompted to allow a program you don't know, choose "No"

and search your hard drive for a program of that name. Then, decide if it really is legitimate or delete it if it is not.

2) When you are prompted to allow a program you don't know, disconnect any dial-up connection, disconnect any network connection, then choose "Yes". The program will appear in McAfee Firewall's list of networking applications. You can then right-mouse click on the name and choose the menu item "Where is it?". Then you will be given the full path to the executable, so you can decide whether to delete it or not.

 BO and NetBus will undoubtedly be altered very quickly to evade virus scan programs. The original authors weren't as ruthless as they could have been. McAfee Firewall has been designed to catch such trojans regardless of their design.


What is "Unknown Traffic"?

This is traffic that was not expected.

 Don't panic - not all entries are hacking attempts.

Traffic shows up here if it did not match what applications were doing and was not allowed or blocked under any of the System settings. If you are flooded with a continuous stream that appears here, it is probably someone intentionally attacking your system, trying to disrupt your connections.

Application traffic will appear here occasionally, especially if the network link is slow.  Also, if you are on a busy network, your system may receive traffic that is not important (some packets are broadcast to all other systems, even though they are important to just a few).

See Also

Detail on "Unknown Traffic", Logging Option


What protocols can McAfee Firewall filter?

McAfee Firewall can filter TCP/IP, UDP/IP, ICMP/IP and ARP. It intercepts all protocols, but others, such as IPX, must be either allowed or blocked - no filtering is done.

The Internet uses the IP protocols. No others are sent. Also, IP networks are the most common.


How is System traffic treated differently than application traffic?

McAfee Firewall monitors application-level communication and allows it based on whether the application is trusted or not. System traffic is not intercepted in the same way and is not necessarily associated with any particular application.

As a result, system functions are either allowed or blocked, based on your settings.  Also, monitoring and logging is not done on a connection basis, rather all packets are handled individually.

Under the "System" tree in the display, there is a separate entry for each of the filtered system functions. If you choose to show send and receive for a system function, any traffic for it will cause the icon (picture) to flash a red (for blocked) or green (allowed) box to indicate the event.

See Also

Applications Subtree, System Subtree


Properties: NetBIOS over TCP
NetBIOS over TCP Settings

You can choose to allow your system to reach other system's shares as well as choosing to allow others to reach your shares. It is recommended that you not allow people to reach your shares from any device connecting to the Internet.

This control page is for NetBIOS over TCP/IP. You can also send NetBIOS over other protocols such as IPX and NetBEUI (note: only IP protocols can be sent through the Internet), then you must control NetBIOS using the "Other non-IP Protocols" settings.

NetBIOS is typically sent using UDP ports 137 and 138 and TCP port 139. In order for systems to send broadcasts and find each other, they use UDP port 137 and UDP port 138. For your system to connect to a remote system to share one of its devices, it must make a TCP connection to remote port 139.

If access is allowed for  reaching "other systems' shares", then traffic on UDP ports 137 and 138 is allowed and traffic is allowed to remote TCP port 139.

If access is allowed for "others reaching my shares", then traffic on UDP ports 137 and 138 is allowed and traffic is allowed to local TCP port 139. Caution: This is allowing any other system to reach your shares, through this device.

Note: WINS uses UDP port 137 also. Controlling NetBIOS over TCP controls WINS as well.

See Also

NetBIOS over TCP Subtree, Other non-IP Protocols


Properties: Identification
Identification Settings

Some applications support a simple identification service for remote systems who want to know who you are before allowing you access to their service. Common examples are email and IRC (Internet Relay Chat).

This is allowed, by default, since it is commonly used. You can disallow it if, for example, your email server does not require it. Most IRC servers require it when you connect, but never check again, once you are connected.

See Also

Identification Subtree


Properties: ICMP
ICMP Settings

ICMP is a protocol used to notify other systems and help proper data flow. It was designed for a trusted environment - far from the reality of the Internet.

ICMP is blocked by default, since it can be spoofed.

A common attack that uses ICMP is where the attacker (wrongly) tells your system that it cannot reach another system. This is common in the IRC community. This attack typically requires a long flood of packets, so you can be fairly safe if you limit ICMP to about 3 packets per second. If you are flooded, block all ICMP.

See Also

ICMP Subtree


Properties: ARP
ARP Settings

ARP is an Ethernet protocol that lets systems find each other's Ethernet Addresses on a network. It is not transmitted through the Internet, and is not considered a security threat.

ARP is allowed by default and it is recommended that you leave it allowed, unless advised by your network administrator/security advisor.

See Also

ARP Subtree


Properties: DHCP
DHCP Settings

DHCP is a popular method of assigning IP addresses on large networks. It is commonly used by cable companies providing Internet access. It is rare or non-existent for dial-up ISP connections.

DHCP is disallowed by default. If your network/ISP uses it, you should allow it. It uses UDP ports 67 and 68.

See Also

DHCP Subtree


Properties: Other IP protocols
Other IP Protocol Settings

There are many other IP protocols, however they are not commonly used. They are not filtered by McAfee Firewall, rather they are each either allowed or blocked completely. To configure an individual IP protocol, select it in the list and then use the check boxes to the right to allow (or block), block incoming fragments, log allowed traffic or log block traffic.

By default, IP protocols other then TCP, UDP and ICMP are blocked. TCP, UDP and ICMP can not be configured in this place because they are filtered according to other System Settings and the activity of applications..

See Also

Non-IP Protocol Settings, Other IP Protocol Subtree


Properties: Non-IP protocol
Non-IP Protocol settings

There are many other protocols besides IP, for example, IPX, PPPoE, Appletalk and NetBEUI. These protocols are not transmitted through the Internet and IP is becoming the most common choice. PPP over Ethernet, however is being used by ISP's to carry Internet access over DSL lines.

By default, non-IP protocols are blocked. If you use protocols other than IP or if your ISP uses PPPoE, you must allow them (as shown in the figure above).  They are not filtered by McAfee Firewall, rather they are either allowed or blocked completely.

See Also

Non-IP Protocol Subtree, Other IP Protocol Settings


What network devices does McAfee Firewall support?

McAfee Firewall supports Ethernet and Ethernet-like devices on Microsoft Windows 95, 98 and NT 4.0 SP4 and SP5. This includes dial-up connections, most cable and ISDN modems and most Ethernet cards. It does not support Token Ring, FDDI, ATM, Frame Relay and other networks.

Some device drivers may not be supported. If you have a device that is not supported, please email us at cpd@signal9.com to let us know.


How am I protected after installation?

McAfee Firewall protects you only when it is running. The install procedure recommends that you reboot. This is necessary if networking applications are currently running.

We recommend that you run McAfee Firewall before you start networking applications.

See Also

How do I monitor an applications network activity?,

How does McAfee Firewall control System activity?,

How will McAfee Firewall help me?


 Reference

Activity Tree                                                                                          Details Window

There are several controls to operate McAfee Firewall: the menu at the top, Network Control and Display options below and the Activity Tree and Details Window at the bottom. For more information, select one of the following:

Menu Items

File

Settings

Display

Help

Network Control Options

Application Display Options

Logging Options

Activity Tree

Details Window

Setup Warnings


How to check if your devices are shared

On Microsoft Windows 95, 98 and NT 4.0+, the File Explorer program shows a little hand under a device or folder that is shared:

In the figure above, the A: floppy drive is shared, but the C: drive is not. To change the setting, right-mouse click on the device and choose the "Sharing" menu option:

This will bring you to a "dialog box" where you can choose whether or not to share the device:

After making your changes, click OK.

You should also use McAfee Firewall to protect yourself. Click here for more information.


spoofing
Spoofing - falsifying packet information,

in particular, the addresses.


ARP
ARP - Address Resolution Protocol


DHCP
DHCP - Dynamic Host Configuration Protocol


WINS settings

WINS shares a UDP port with NetBIOS over TCP - port 137.

If you require WINS, you should allow it by allowing your system to "reach another system's shares".


System-generated DNS

The operating system generates UDP-based DNS requests using local port 137 and remote port 53. This is not currently allowed by McAfee Firewall because:

•  UDP port 137 is used by NetBIOS over TCP and should not be exposed unnecessarily, and

•  there is no apparent consequence to blocking it.


 Glossary

Address	Administrator	ADSL

Allow/Block	ARP	Authentication

BO	BRKill	Broadcast

Button	Connection	Winsock

Cookies	datagram	Default

DHCP	Dialog Box	DNS

Email	ephemeral	Ethernet

Fileshare	Filter	finger

Firewall	FTP	GRE

Hacker	HTTP	HTTPS

ICMP	ICQ	Identification

inbound packet	IP	IPX

IRC	ISDN	ISP

Listening	Local	Log File

Menu	Message Box	Modem

NetBEUI	NetBIOS	NetBus

Netware-IP	Network	Network Device

News	ntp	Operating System

outbound packet	Packet	Packet Filter

Password	Phone Book	ping

POP2	POP3	Port

PPP	PPPoE	PPTP

Printshare	Protocol	RARP

RAS	Remote	RIP

Service	SLIP	SMTP

SNMP	SPX	TCP

Telnet	tftp	Toggle

trojan	Tunnel	UDP

virus	VPN	WINS


Address
Address - a data field in a packet header that specifies either the sender or the intended receiver of the packet.  Note that computers can often see data packets that are not intended for them.


Administrator
Administrator - the person responsible for computer configurations and support.


Allow/Block
Allow/Block (packets) - the action to take on a packet.  Block means the packet is not sent/received.  Allow means it is sent/received.


Authentication
Authentication - the property of knowing that a person or system is who they say they are.

This can be achieved by Virtual Private Networks.


BO
BO - short for "Back Orifice", a trojan remote control program. This program was designed to illustrate the serious security breaches that are possible when using the Windows operating systems and, indeed, it has been used to cause a lot of mischief and damage.

BO's default setup is to listen on UDP port 31337. There are many programs available to detect the standard version of BO - some free.


Broadcast
Broadcast (networks) - a message that is addressed to all computers on a specified subnetwork.


Button
Button - an item on a window that causes an action to be performed when it is "pressed", (usually by clicking the mouse button when the cursor is on it).


Cookies
Cookie - a file placed on your hard drive by a web site you visit. The original intent was for cookies to contain information about your preferences, so they can tailor the appearance to your wants. This will save time when you next visit the site.

The security risk with cookies is that, since they are written directly to the hard drive, they can store something dangerous (a virus) or private (a password).  There is also concern that one website can get a cookie created by another website.  It appears that cookies cannot be used to get other data from a user's hard drive (such as, applications used, database, address book, personal files, etc.).  Cookies can, on the other hand, be used to track where a user has been within a web site.

Netscape Navigator can be set to ask you whether or not you will accept a cookie.

We suggest you do not allow cookies unless you have a reason for doing so.


Connection
Connection - a method of data exchange that allows a reliable transfer of data between two computers.


Default
Default (settings) - the configuration and behaviour on installation, before any changes are made.


Dialog Box
Dialog Box - a window used to help the user enter information.


DNS
DNS - Domain Name Service, a service for mapping computer names to their IP Address.


Email
Email - electronic mail, a method of sending messages to other people via computer networks.


Ethernet
Ethernet - the most common type of local area network (LAN).


Fileshare
Fileshare - a file system resource available through a network connection.

Your system uses UDP broadcasts to announce its presence on a network and listens to see who is out there.  This is alright in a trusted office environment, but is completely inappropriate for an Internet connection.

More..


Filter
Filter (firewalls) - a tool used to intercept all incoming and outgoing network traffic and block all that is unwanted. McAfee Firewall filters traffic.


finger
Finger - a service that finds information about a user.


Firewall
Firewall - a service that controls the transfer of data between a computer or network and the surrounding network(s).  The firewall is responsible for filtering all packets and often provides proxy services to protect internal computers.

McAfee Firewall is not a traditional firewall, but it does protect your PC in this fashion.


FTP
FTP - File Transfer Protocol, a high-level protocol for file transfer.


GRE
GRE - Generic Routing Encapsulation. This protocol is used by PPTP.


Hacker
Hacker - there are many definitions. The one used here is a a person who misuses computer resources, often finding or damaging information.


HTTP
HTTP - Hypertext Transfer Protocol, a powerful tool used primarily for browsing the World Wide Web.


HTTPS
HTTPS - Secure HTTP.  This is a variation of HTTP that uses encryption to add privacy.

Don't do online banking and credit card transactions without secure measures such as this.


Identification
Identification - a service that provides user information to another system, so they can try to verify your identity.  If you block it, other systems (such as email servers) may refuse you their services.

This service is also known as "ident" or "auth".


ICMP
ICMP - Internet Control Message Protocol, a maintenance protocol that handles error messages and helps network debugging.  ICMP is carried in IP packets.

ICMP is easily abused and has become a serious annoyance to IRC chatgroup users.  Because other people can find out information about you, such as your IP address, they can easily send false ICMP messages to your system, causing it to promptly drop your IRC connection.


ICQ
ICQ - an Internet service that helps people find each other and share information.  ICQ has been found to have security weaknesses.


inbound packet
inbound packet - a packet arriving from a remote computer or network.


IP
IP - the essential network protocol of the Internet.  It supports TCP, UDP, ICMP and many others.  McAfee Firewall filters TCP, UDP and ICMP, and System Settings allow you to allow or block the remaining protocols.


IPX
IPX - a network protocol, most commonly used by Novell.  It supports SPX.  Also, it can be tunneled over IP.

McAfee Firewall can block IPX and other non-IP protocols.


IRC
IRC - Internet Relay Chat.  A service that lets people on the Internet share a typed conversation.  Whatever a person typed is sent to other people in the "chat group".

The risk here is that people might become hostile and try to "nuke" you or send you unpleasant email.  Consider NetNanny to screen the messages that are sent in IRC.

 There are some very nasty people on IRC, including pedophiles and "cyberstalkers".


ISP
ISP - Internet Service Provider, the company that sells you access to the Internet.


Local
Local (Address or Port) - refers to your machine, as opposed to a remote machine.


Log File
Log File - a record kept to track activity.  The log file helps monitor what connections your computer has made and where unauthorized access (may have) originated.


Menu
Menu - a list of commands that are available.  If a command is in gray, it is not available.


Message Box
Message Box - a message window that appears briefly to tell the user information.


Modem
Modem - a device that sends and receives data over a connection, most commonly over a telephone line, cable, ADSL or ISDN.


NetBus
NetBus - a program designed to install without the user knowing about it and allow remote control of the system, including keyboard logging and file access.

NetBus uses TCP ports 12345 and 12346 by default.


NetBIOS
NetBIOS - a protocol that supports file and print shares.  This protocol can be carried over TCP and UDP or IPX or NetBEUI.

You can choose to "allow me to reach other system's shares", or "allow others to reach my shares".


NetBEUI
NetBEUI - NetBIOS Extended User Interface.  A local-area protocol that operates underneath the NetBIOS interface.

McAfee Firewall does not currently filter NetBEUI.To allow it, you must allow all non-IP protocols.


Netware-IP
Netware-IP - A Netware protocol sent using the IP protocol.


Network
Network - a channel used to support communication between computers, e.g. Ethernet or Internet.


Network Device
Network Device - a hardware computer component that connects your computer to a network, such as Ethernet or Internet.


News
News (NNTP) - a service available through most ISPs where thousands of newsgroups discuss specific topics, and users may post relevant articles.

 Remember that anything you post will be archived permanently and can be retrieved at such website as www.deja.com. Also, if you post using your real email address, you WILL receive an unending stream of "spam" (junk email).


ntp
ntp - Network Time Protocol, a service that supplies the time.


Operating System
Operating System - the low-level program that supports the running of all other programs on a computer.  OS/2, Linux and Windows are operating systems.


outbound packet
outbound packet - a packet leaving your computer or network to a remote destination.


Packet
Packet - a block of data sent over a communication medium, such as the Internet.


Packet Filter
Packet Filter - a function of a firewall that checks inbound and outbound packet, and allows or blocks them, depending on predefined rules.


Password
Password - a secret character sequence used for authentication.

 Passwords can be stolen by trojans such as BO and NetBus.  For better security, consider token-based authentication or one-time passwords.


Phone Book
Phone Book - a set of dial-up services available on your system (look on your system for Dial-Up Networking).


ping
ping - an ICMP-based service used to verify the availability of computers on a network.


POP2
POP2 - Post Office Protocol, version 2.  Used to transfer email.


POP3
POP3 - Post Office Protocol, version 3.  Used to transfer email.


Port
Port - a number used by protocols such as TCP and UDP to identify a communication instance.


PPP
PPP - Point-to-Point Protocol, a low-level protocol used to transport higher-level protocols such as IP.


PPTP
PPTP - Point-to-Point Tunneling Protocol


Printshare
Printshare - a printer resource available through a network connection.


Protocol
Protocol - a standardized method of communication, e.g. IP.


RARP
RARP - Reverse Address Resolution Protocol, an Ethernet protocol used to resolve IP addresses.


RAS
RAS - Remote Access Service, a service that supports dial-up connections.


Remote
Remote (Address or Port) - refers to another machine you might communicate with, as opposed to your (local) machine.


RIP
RIP - Routing Information Protocol, a UDP-based protocol used to send routing information to systems on a network.


Service
Service - an application or function often considered part of the operating system.


SLIP
SLIP - Serial Line Internet Protocol, a predecessor to PPP.


SMTP
SMTP - Simple Mail Transfer Protocol, a popular email protocol.


snmp
SNMP - Simple Network Management Protocol.  A protocol used to manage networks and routing.


TCP
TCP - a connection-based Internet Protocol carried in IP packets.  Examples of TCP-based applications and services are FTP, web browsing, email, and IRC.


tcpmux
tcpmux - TCP Port Service Multiplexer.


Toggle
Toggle - a setting that switches between two positions or values.


tftp
tftp - trivial file transfer protocol, a UDP-based file transfer protocol.  tftp is a security risk because it involves no interaction with the user - it can occur without you knowing about it.


Telnet
Telnet - a TCP-based service that supports remote logins (usually to UNIX systems).

 With telnet, you are sending your username and password over a network and they may be stolen by someone and used to break in.  Consider a VPN for privacy.


Tunnel
Tunnel - encapsulating one protocol or data stream within another.  A Virtual Private Network (VPN) tunnels data by encrypting it and then encapsulating it within a protocol such as TCP (better) or UDP (worse).


UDP
UDP - a connectionless (datagram) Internet Protocol carried in IP packets.  Examples of services and applications that use UDP are ICQ, DNS, NetBIOS (for broadcasts etc.) and RIP.


virus
virus (software) - a piece of code that works without the knowledge of the recipient. It is transmitted inside other software, can duplicate itself, spread and damage your data and/or system.


VPN
VPN - Virtual Private Network.  A secure private connection, usually through an untrusted network.  You can link the LAN's of two offices through the Internet using a VPN, and systems in either office can access those in the other, as if they were on the same LAN.  The route through the Internet is invisible.  Hackers or snoopers on the Internet just see encrypted traffic and cannot get your private information.

Another configuration of a VPN is "client/server", where computers, such as laptop PCs connect to a VPN server which gives access to a protected network.  Home or mobile workers can connect to the office and have the same secure  link and can access office systems.


WINS
WINS - Windows Internet Name Service, a protocol similar to DNS.


Winsock
Winsock - a part of the Microsoft Windows operating systems that handles most network connections and some ICMP. It does not handle file or print shares.


Scream credits
Edvard Munch, The Scream.

This picture indicates comments

for the highly security-conscious.


SPX
SPX - Sequenced Packet Exchange, a connection-based IPX protocol


ISDN
ISDN - Integrated Services Digital Network


ADSL
ADSL - Asynchronous Digital Subscriber Line


Internet
Internet - the world-wide network of computers that is available to many home users, companies and institutions. The Internet uses the IP protocols for communication.


Menu: File
File Menu Item

Save Settings - save the current configuration setting to disk. This is done automatically when the program exits, so this is not usually necessary. It is useful for saving changes and then "purging" the password, so that future changes cannot be made (by other users).

Password - displays another popup menu with password options to let you protect your configuration (prevent tampering):

Enter - (grayed when passwords are not being used or when it has been entered). This menu item is used to enter the password.

Purge - (grayed when passwords are not being used or when the correct password has not been entered). This menu item is used to make McAfee Firewall "forget" the password and disable controls until the password is re-entered. This is useful so the Adminstrator can enter the password, make setting changes, save them and then purge the password, so other users cannot make other setup changes.

Set - used to set a new configuration password. If the password has not yet been entered, the program prompts for it. The password cannot be changed until the current one has been entered.

Required - When checked, as shown in the figure above, it indicates that a configuration password is required before settings can be changed. This is a toggle, so selecting it makes it change to the opposite. If it is checked and you don't want to use a password to protect the configuration any more, you should select this menu item.

Log File - You can set the directory path in which the log file will be written. Also, you can set the maximum log file size, after which normal log entries are suppressed. Click here for details.

Start automatically when Windows starts - When this item is selected, the program starts automatically when Windows boots. At bootup, the program starts before a user logs in, so that the system is protected as soon as possible.

Exit - exit McAfee Firewall. Note: When you exit, the program will not protect your PC and log events. It is recommended that you run McAfee Firewall before other applications and exit it after you are done.


Menu: System Settings
System Settings

This dialog box allows you to choose which network device to set.

"Network Devices" list

The "Network Devices" list will show all the network devices that McAfee Firewall is protecting. Note: if you have an active network device that is not in the list, it is either not working or is not supported by McAfee Firewall, in which case, communication through this device is not controlled.

To select a network device, right-mouse click on its name.

"Restore Defaults" button

If you choose "Restore Defaults", the settings for the highlighted network device will be changed back to the default settings.

"Properties" button

Choose "Properties", to view and modify the settings for the selected network device.

See Also

Network Device Properties, What are the default settings for System activity?


Menu: App Settings
Application Settings

This dialog box allows you to set  network application controls. McAfee Firewall will monitor and control only the applications that communicate over the network. It will not show other applications, such as editors.

"Trust all applications" toggle

When this toggle is set, as shown here: , all applications will be assumed safe and will be allowed to communicate freely. McAfee Firewall will not block them and will not ask you before allowing new ones. This is the easiest way to operate when you want to only monitor application behaviour without restricting it.

When this toggle is not set, as shown here: , McAfee Firewall will allow applications to communicate only if the user approves them. That is, if an application runs that is not in the "Trusted Applications" list, McAfee Firewall will prompt the user, asking if the application should be allowed to communicate:

The above figure shows what happens the first time the application "MIRC32.EXE" is run after using McAfee Firewall. The message box asks the user if they want to "Allow MIRC32.EXE to communicate?", "Yes" or "No". If "Yes" is chosen (the default), MIRC32.EXE will run normally. If "No" is chosen, MIRC32.EXE will not be able send or receive anything.

Modifying the "Trusted Applications" and "Blocked Applications" lists

These lists are updated automatically when you choose to allow or block applications. If "Trust all applications" is set, then applications are automatically added to the "Trusted Applications" list.

Four buttons are added to let you control entries. Changes take effect when you choose OK. If you choose Cancel, the changes do not take effect.

 Move to "Trusted" list.

The highlighted application in the "Blocked" list is moved to the "Trusted" list.

This means the application will be allowed to communicate.

 Move to the "Blocked" list.

The highlighted application in the "Trusted" list is moved to the "Blocked" list.

This means the application will not be allowed to communicate.

 Delete from "Blocked" list.

The highlighted application is deleted from the "Blocked" list. The next time the application is run, McAfee Firewall will treat it as if it were the first time the application was run and either prompt to allow it or allow it automatically, depending on whether "Trust all applications" is set.

 Delete from "Trusted" list.

The highlighted application is deleted from the "Trusted" list. The next time the application is run, McAfee Firewall will treat it as if it were the first time the application was run and either prompt to allow it or allow it automatically, depending on whether "Trust all applications" is set.

See Also

Applications Subtree


Menu: Settings
Settings Menu Item

Application Settings - view and modify application control settings.

System Settings - view and modify System control settings.

Fragmented Packets - control fragmented packets


Properties
Network Device Properties

This dialog box allows you to set System access controls for the selected network device. The major system service are listed here. If your system uses another function, please let use know by email to cpd@signal9.com

The following pages are shown:

NetBIOS over TCP	- Network Neighborhood and device sharing (controls WINS also)

Identification	- allowing other systems to ask for your identity

ICMP	- network control messaging (often abused)

ARP	- for reaching local machines

DHCP	- assigning IP addresses dynamically

RIP	- communicate routing information

PPTP	- used by Microsoft for encrypting transmissions

Other Protocols- all other protocols than TCP/IP, UDP/IP, ICMP/IP and ARP

See Also

System Settings


Menu: Help
Help Menu Item

Contents - This displays the opening page of the help file, where the main sections are listed.

What is a..  - displays the Glossary, where many technical words are defined.

PPPoE - Help on configuring CPD to work with PPP over Ethernet.

Search for Help on.. - takes you to the standard search engine for help files.

How to Use Help - takes you to the standard help on using help.

How helpful was the help? - We would like to hear if the help file answered your questions or if it left you confused. Please email cpdhelp@signal9.com with your comments.

Acknowledgements - A (partial) list of the many people to thank for helping make McAfee Firewall the program it is.

About - information about McAfee Firewall.


How can I still be harassed, even with McAfee Firewall?

Normal TCP connection.                        Client-side "nuke" of TCP connection.

Many people use McAfee Firewall to block the "nukes" that cause their IRC connections to be broken (shown in the diagram above). While McAfee Firewall blocks the nukes, there are other ways that attackers can still cause the connections to be broken:

Server-side nuking

This is when the "nukes" are sent to the IRC server, not to your computer, telling the server that you can no longer be reached. To prevent this, the IRC server needs a firewall.

Server-side nuke of TCP connection.             Flood blocking a TCP connection.

Flooding from a higher-speed connection

If a flood of packets is sent to you from a higher speed connection, McAfee Firewall can stop the packets, but the flood takes up all your bandwidth. Your system does not get a chance to send anything. Dial-up users are particularly vulnerable since they have the lowest speed connections.

Based on our experience, one dial-up user cannot flood another dial-up user successfully.


trojan
trojan - a program or piece of executable code that is transmitted without the user's knowledge, often allowing outsiders to break into or control the system


Group Box: Network Control
Network Control Options

The "Network Control" options give you complete control of your PC's networking activity. Only one of the three options may be selected. In the figure above, "Filter Traffic" is selected". This is the default setting.

Block Everything

When this option is selected, as shown here: , all network traffic is blocked. Nothing will be sent from your system and nothing will be received.  For dial-up devices, the PPP layer is not intercepted, so you can still connect to your ISP. Traffic is not displayed or logged.

This option is useful when you are being flooded or are facing a security concern. There are cases where you shouldn't block everything for extended periods of time, for example:

1) Dial-up connections to an ISP are usually disconnected if they are idle.

2) Network connections using DHCP (e.g. cable modem) must allow DHCP through. An IP address assigned by DHCP is "leased", which means it may be taken away and another one assigned to you. If you block it, you will conflict with other users and become very unpopular with your ISP, who may cancel your service.

Filter Traffic

When this option is selected, as shown in the figure at the top, traffic will be filtered according to your Application and System settings. Also, network activity will be displayed according to the Display settings. This is the only setting where you can have network activity displayed.

Allow Everything

When this option is selected, as shown here: , all network traffic is allowed. Nothing is blocked and all applications, even those in the "Blocked" list, are allowed to communicate.  Traffic is not displayed.

See Also

Application Settings, Display, System Settings


Group Box: Application Display
Application Display Options

The "Application Display" options control how McAfee Firewall displays network activity. Either "Summary" or "Detail" must be chosen. The default is "Summary". If "Detail" is chosen, you may choose "Show Send and Receive".

Summary

When this option is selected, as shown here: , the display and logging of network activity is very limited:

• The Details Window is not shown.

• When a network application is run, it will be shown automatically in the Activity Tree, under the Applications tree.

•  Connections made by applications are not displayed or logged.

•  Current Activity is not shown.

•  Activity Log is not shown.

Detail

When this option is selected, as shown in the figure at the top, display and logging of network activity is done:

• The Details Window is shown.

• When a network application is run, it will be added in the Activity Tree, under the Applications tree. Unlike Summary mode, it is not made visible automatically. It will be visible only if the Applications tree is expanded.

•  Connections made by applications will be added in the Activity Tree, under the application's name. If "Show Send and Receive" is selected, then the connection's icon will flash with every send and receive the application makes on that connection.

•  Current Activity will show all active connections from all applications. In the case of a blocked (untrusted) application, it will show the attempted connection.

•  Activity Log will show the previous connections (that are now closed) made by applications.

•  Application sessions will be logged in the log file.

Show Send and Receive

This option is available only in Detail mode. When selected:

• All application traffic is shown by flashing the connection's icon in the Activity Tree and in the Detail Window, when Current Activity is selected.

•  The number of bytes sent and received is tracked and displayed in the Detail Window, when either Current Activity, Activity Log or an application's connection is selected in the Activity Tree.

Note: This option can slow down network traffic on high-speed connections. To improve speed, turn off this option.

Note: Changing the "Show Send and Receive" option takes effect with new application sessions. When selected, existing sessions will not be affected - they will not show sends and receives.

See Also

Activity Log, Activity Tree, Current Activity, Details Window


Reference: Activity Tree
Activity Tree

Activity Tree, in Summary mode.

Activity Tree, in Detail mode.

The Activity Tree is used to display all the network activity.  Also, some control functions are available through popup menus when you right-mouse click on an entry.

The Activity Tree always starts with "My Computer" at the top level. In Summary mode, there are two subtrees: "Applications" and "System". In Detail mode, there are also subtrees called "Current Activity" and "Activity Log". Another subtree may appear, called "Unknown Traffic". This appears if unknown traffic is blocked.

When an entry in the Activity Tree is highlighted (using the left mouse button - "My Computer is highlighted in the figure above), details are shown in the Detail Window, to the right, if Detail mode is selected. If you double-click on an entry or click the [image] sign to the left of the icon, the subtree will be expanded to show any entries below it. You can "collapse" the display (hide the entries) by double-clicking again, or clicking the [image] sign to the left of the icon.

Choose one of the titles below for more information about the different Activity Tree entries:

My Computer

Applications

Application Sessions

System

NetBIOS

Identification

ICMP

ARP

DHCP

RIP

 PPTP

Other IP protocols

Non-IP protocols

Unknown Traffic

Current Activity

Activity Log

Note: there is a short delay between highlighting an entry in the Activity Tree and seeing its corresponding information in the Details Window. The Details Window is not refreshed when changes are being made, so a refresh may be delayed during times of heavy network activity.

See Also

Activity Log, Applications, Application Sessions, ARP, Current Activity, Details Window, DHCP, ICMP, Identification, My Computer, NetBIOS, Non-IP protocols, Other IP protocols, PPTP, Unknown Traffic, RIP, System


Reference: Details Window
Details Window

The Details Window is shown when in Detail Display mode. It shows detailed information about the highlighted entry in the Activity Tree. The figure above shows details shown on Current Activity.

For more information on the details shown for an entry in the Activity Tree, choose the entry below:

My Computer

Applications

Running Applications

Application Sessions

System

NetBIOS

NetBIOS share

Identification

ICMP

ARP

DHCP

RIP

PPTP

Other IP protocols

Non-IP protocols

Unknown Traffic

Current Activity

Activity Log

See Also

Display


Reference: Current Activity
 Current Activity Subtree

When the "Current Activity" subtree is highlighted, all current application sessions are listed in the Details Window. This entry and the Details Window are shown only while in Detail Display mode. If "Show Send and Receive" is selected, then an application's icon is flashed with a green or red square to indicate data being allowed or blocked, respectively.

In the figure above, there are three sessions opened by mIRC and Netscape:

1) The first entry shows mIRC using local port 1109 to talk to a remote system, whose IP address is 206.66.12.230, on port 6668 (IRC).

2) The second entry shows mIRC listening on port 113 for identification.

3) The third entry shows Netscape using local port 1108 to talk to a remote system, whose IP address is 9.9.9.9, on port 119 (News). The icon is shown as a green arrow to the right.

When "Current Activity" is highlighted, the activity list in the Details Window is updated automatically as connections are opened and closed. The update is delayed during times of heavy load, so during peak times, a refresh may be delayed for a noticeable amount of time.

Click here for a description of the icons that are shown.

See Also

Application Sessions, Details Window, Display mode, Icons Description


Reference: Activity Log
 Activity Log Subtree

When the "Activity Log" subtree is highlighted, the most recent (closed) application sessions are listed in the Details Window. This entry and the Details Window are shown only while in Detail Display mode. The list is limited to the 100 most recent entries. The application's icon is not used. Instead, the generic icon is shown: . A blocked application would be indicated by this icon: .

The figure above shows four of the entries in the Display Window, all from running mIRC (MIRC32.EXE):

1 & 2) The first two are DNS lookups, trying to get the IP address for an IRC server that mIRC knows by name.

3) The third is a connection made by the IRC server, whose IP address is 206.66.12.230, to my system on port 113 (Identification) to check who I am (this is required by most IRC servers).

4) The fourth shows an IRC connection from local port 1097 to the IRC server's port 6667.

See Also

Application Sessions, Details Window, Display mode


Reference: My Computer
 My Computer Tree

This is the "root" of the tree. When it is highlighted, the Details Window shows all of its subtrees: Applications, System, Unknown Traffic (optional), and in Detail Display mode, Current Activity and Activity Log.

Expanding and Collapsing

A [image] to the left means there are entries that can be seen if you click on it, or double click on "My Computer".  A [image] means you can hide the entries if you click on it, or double click on "My Computer".

See Also

Activity Log, Applications, Current Activity, Details Window, Display, Unknown Traffic, System


Reference: Applications
Applications Subtree

The Applications subtree is where applications are shown when they are running. When you run an application that communicates using the network or modem, it is added as an entry, as shown below:

The figure above shows three network applications running: Internet Explorer (IEXPORE.EXE), mIRC (MIRC32.EXE) and Netscape Navigator (NETSCAPE.EXE).  The [image] icon beside IEXPLORE.EXE shows that it is blocked (in the "Block" list under Application Settings) and is not allowed to communicate.  For MIRC32.EXE and NETSCAPE.EXE, the icon is shown to the left of the filename, to help you recognize it.  This icon also indicates they are allowed to communicate. The [image] indicates that mIRC has an active session.

The figure above shows the display when the Applications subtree is highlighted. The applications are listed in the Details Window, to the right. Also, MIRC32.EXE is expanded to show one session. In this case, it is "listening", ready for the IRC server to ask for the person's identity.

The figure above shows the display when the application, MIRC32.EXE, is highlighted. The session(s) are listed in the Details Window. In this case, the tree has been expanded to show the session below the application as well.

Expanding and Collapsing

A [image] to the left (as shown for MIRC32.EXE above) means there is at least one active session for an application. You can click on [image], or double click on the application.  A [image] means you can hide the entries if you click on it, or double click on the application.

Popup Menus

If you right-mouse click on the "Applications" subtree, a popup command menu is shown:

Settings - brings up the Application Settings dialog box.

If you right-mouse click on an application, a popup command menu is shown:

Where is it? - This command tells you the directory path of the running application. This is useful if you find an application you don't trust and you want to delete it from your system.

Stop - This command lets you stop the highlighted application. Note: some applications mess up when stopped this way. Try to stop the application normally before resorting to this method.

Application Details

In Detailed Display mode, an application's sessions are shown as subtree entries under the application.  Click here for more information on displaying application sessions.

See Also

Application Sessions, Application Settings, Display


Reference: System
System Subtree

The System subtree is where system-related traffic is shown. Under the System subtree, the major networking functions are shown:

System Subfunctions

The following system subfunctions are shown as entries under the System subtree:

NetBIOS

Identification

ICMP

ARP

DHCP

RIP

PPTP

Other IP protocols

Non-IP protocols

Popup Menus

If you right-mouse click on the "System" subtree, a popup command menu is shown:

Settings - brings up the Application Settings dialog box.

Expanding and Collapsing

A [image] to the left means there are entries that can be seen if you click on it, or double click on "System".  A [image] means you can hide the entries if you click on it, or double click on "System".

See Also

ARP, DHCP, ICMP, Identification, NetBIOS, Non-IP protocols, Other IP protocols, RIP, PPTP


Reference: Unknown Traffic
Unknown Traffic Subtree

The "Unknown Traffic" subtree, shown under System,  is where all unknown traffic is shown. If you are being flooded or are under network attack, packets will be indicated here. All traffic shown here has been blocked, so the icon is flashed with a red box to indicate this.

There is two cases where legitimate traffic will be blocked and recorded here:

1) When several DNS servers are queried and a response from an earlier query comes after a later one.

2) The final "closing" packets are returned on a slow or unreliable Internet connections.

See Also

What is "Unknown Traffic"?


Reference: Application Sessions
Application Sessions

An application's sessions are listed under the application in the Activity Tree and under the Current Activity subtree, when in Detailed Display mode. In the figure above, the application, MIRC32.EXE (mIRC), is listening on TCP port.

The word "session" is used rather loosely here to mean either a connection, as in TCP, or a connectionless exchange, as in UDP. To be precise, it is an instance of a "socket" being used.

When a session is highlighted in the Activity Window (as above), the details are shown in the Details Window:

Protocol - the protocol used for the session

Remote Name - the name for the IP address used, e.g. www.signal9.com (this is not yet implemented, so the name will not appear)

Remote IP address - the IP address of the remote system to which the application is communicating

Remote Port - the port used on the remote system. This is often a good indication of the type of traffic, since functions such as email and web browsing each use a different port.

Local Port - the port used on your system. When you use a service on another system, your local port is usually ephemeral (in the range 1024-5000).

Start Time - the date and time when the session was opened. For a listener, this does not mean a connection was accepted at this time.

Up time - the time, in seconds, that the session has been open. This value is updated every second.

Application - the application to which this session belongs.

Bytes Sent - the number of bytes sent by this session. This value is updated if "Show Send and Receive" is chosen. Otherwise, it may not be accurate.

Bytes Received - the number of bytes received by this session. This value is updated if "Show Send and Receive" is chosen. Otherwise, it may not be accurate.

See Also

Current Activity, Display


listening
Listening - TCP connections are made to a "listening" port that is ready to accept an incoming connection. The icon for a listener in the Activity Tree is an ear:


ephemeral
ephemeral (port) - used temporarily, in the range 1024-5000. In McAfee  Firewall, this range was called the "Temporary Range".


Reference: NetBIOS
NetBIOS Subtree

The NetBIOS subtree, shown under System,  is where NetBIOS activity is shown.  If you open a file or printshare on another system, or one of your file or printshares is opened, it will be shown as an entry under this subtree, as shown below:

The figure above shows that someone with username "GRANNY" on a system called "NOSY" has opened a fileshare to my A: drive. The next entry shows that I have opened a fileshare, \\NOSY\C and can access it as F:. In this case \\NOSY\C means the C: drive on the system called "NOSY". When these fileshares are disconnected, the entry in the Activity Tree and the Details Window will be removed. Fileshare acitivity is recorded in the log file.

If logging is selected, the icon will flash with either a green box or red, depending on whether the packet was allowed or blocked.

Popup Menu

If you right-mouse click on shares shown under the NetBIOS subtree, a popup command menu is shown:

If you choose "Disconnect", the highlighted share will be disconnected. Note:

If you want to prevent unauthorized fileshare access, you should use the sharing protection provided by the Operating System first. The share you disconnect here may be reconnected automatically. You may want to "Block everything" until you have the sharing protection set.

See Also

NetBIOS over TCP Settings, How to check if your devices are shared, Network Control


Reference: Identification
Identification Subtree

The Identification subtree, shown under System,  is where identification activity is shown. When a remote system connects to check your identity, the connection information is shown in the Details Window, as shown below:

In the figure above, the icon is flashed with a green square to indicate the traffic was allowed through. If "Identification" were blocked with logging on, the icon would be flashed with red square.

Connection information is shown for about 10 seconds, then it is removed. An entry is made in the log file, if logging is chosen.

See Also

Identification Settings


Reference: ICMP
 ICMP Subtree

The ICMP subtree, shown under System,  is where ICMP activity is shown. If logging is selected, the icon will flash with either a green box or red, depending on whether the packet was allowed or blocked.

See Also

ICMP Settings


Reference: ARP
ARP Subtree

The ARP subtree, shown under System,  is where ARP activity is shown. If logging is selected, the icon will flash with either a green box or red, depending on whether the packet was allowed or blocked.

See Also

ARP Settings


Reference: DHCP
DHCP Subtree

The DHCP subtree, shown under System,  is where DHCP activity is shown. If logging is selected, the icon will flash with either a green box or red, depending on whether the packet was allowed or blocked.

See Also

DHCP Settings


Reference: Other IP protocols
"Other IP protocols" Subtree

The "Other IP protocols" subtree, shown under System,  is where all traffic for all IP protocols, other than TCP, UDP and ICMP, are shown. Logging cannot currently be selected for these protocols, so the icon will not flash with either a green box or red to indicate traffic was allowed or blocked.

See Also

Other IP Protocol Settings


Reference: Non-IP protocols
"Non-IP protocols" subtree

The "Non-IP protocols" subtree, shown under System,  is where all traffic for protocols other than IP and ARP are shown. If logging is selected, the icon will flash with either a green box or red, depending on whether the packet was allowed or blocked.

See Also

Non-IP Protocol Settings


Icons Description
Description of Icons

In Detailed Display mode, an application's network activity is shown as entries under the application in the Activity window and all application activity is shown by highlighting Current Activity. Many different icons are used to illustrate what is happening:

 An application is listening on a TCP port.

 An application has been blocked from listening on a TCP port.

 An application has an open TCP connection.

 An application has been blocked from opening a TCP connection.

 An application wants to receive on an open datagram session (e.g. UDP or ICMP).

 An application has been blocked from receiving on a datagram session (e.g. UDP or ICMP).

 This indicates traffic being allowed in.

 This indicates traffic being allowed out.

 This indicates inbound traffic being blocked.

 This indicates outbound traffic being blocked.

See Also

Current Activity, Detailed Display mode


datagram
datagram - a single, unsequenced packet. UDP is a datagram-based protocol.


Detail: NetBIOS share
Detail on NetBIOS shares

No details are currently made available on NetBIOS shares.


Detail: My Computer
Detail on "My Computer"

When "My Computer" is highlighed in the Activity Tree, the "subtrees" are listed in the Details window. These are "Applications", "System", "Current Activity", "Activity Log" and sometimes "Unknown Traffic".

For information on any of these, you can either highlight the subtree item in the Activity Tree or double-click on it in the Details window.

See Also

Activity Log, Applications, Current Activity, Unknown Traffic, System


Detail: Applications
Detail on "Applications"

When "Applications" is highlighed in the Activity Tree, the running network applications are listed in the Details Window. Applications that do not use the network are not monitored in any way by McAfee Firewall. Applications are listed in alphabetical order. The application's icon is used to help you recognize it. If an application is blocked, the icon [image] is used to indicate this.

In the figure above, IEXPLORE.EXE (Internet Explorer) has been blocked (it is in the blocked list under Application Settings). MIRC32.EXE (mIRC) and NETSCAPE.EXE (Netscape Navigator) are allowed.

See Also

Activity Tree, Application Settings


Detail: Application Sessions
Detail on Application Sessions

When an application's session is highlighed in the Activity Tree, detailed information about the session is listed in the Details Window. Information is listed in columns, and the list may be sorted (in ascending order) by any column by clicking on the column's header.

The information is displayed in two columns entitled "Data" and "Value". The following data are listed:

Protocol - the protocol used for the session (e.g. TCP/IP, UDP/IP, etc.)

Remote Name - the name of the remote system, e.g. www.signal9.com

Remote IP Address - the IP address of the remote system

Remote Port - the remote port used

Local Port - the local port used

Start Time - the date and time when the session was started

Up Time (seconds) - how long the session has been open

Application - the application that opened the session

Bytes Sent - the number of bytes sent

Bytes Received - the number of bytes received

The "Up Time" is updated continuously. When traffic is sent or received by a session, the "Bytes Sent" and "Bytes Received" is updated, if "Show Send and Receive" is selected.

See Also

Activity Tree


Detail: Running Applications
Detail on Running Applications

When a running application is highlighed in the Activity Tree, as shown above, its active sessions are listed in the Details Window. An icon is shown for each entry, to help you identify what it is. Click here for more information about the icons.

If "Show Send and Receive" is selected, the traffic is indicated by flashing the session's icon in the Activity Tree. The corresponding icon in the Details Window is not flashed.

The entries in the Details Window summarize the session endpoints. They show the local address and port and the remote address and port. In the figure above, the entry "Me [ephemeral] - 206.66.12.230 [IRC]" means there is a connection from my system, on an ephemeral port, to remote system 206.66.12.230 on a port used for IRC. The second entry "Me [Identification] - * [*]" means there is a listener on my system for Identification, to which any remote system can connect on any of its ports.

See Also

Activity Tree, Icons Description, Display


Detail: System
Detail on "System"

When "System" is highlighed in the Activity Tree, the "subtrees" are listed in the Details window. These are "NetBIOS", "Identification", "ICMP", "ARP", "DHCP", 'RIP", "PPTP", "Other IP protocols" and "Non-IP protocols".

For information on any of these, you can either highlight the subtree item in the Activity Tree or double-click on it in the Details window.

See Also

ARP, DHCP, ICMP, Identification, NetBIOS, Non-IP Protocols, Other IP Protocols, RIP, PPTP


Detail: NetBIOS
Detail on "NetBIOS"

When "NetBIOS" is highlighed in the Activity Tree, any shares are listed in the Details Window.

In the figure above, one fileshare has been opened on another system.
\\NOSY\C is the "C:" drive on "NOSY" and it is available on my system as" F:". If any shares were open on my system, they would be listed as well.

Popup Menu

A popup menu is available if you right-mouse click on shares listed in the Details Window. You can disconnect the listed share.

See Also

Activity Tree, NetBIOS over TCP Settings


Detail: Identification
Detail on "Identification"

When "Identification" is highlighed in the Activity Tree, any recent Identification communication is listed in the Details Window, if logging is selected under System Identification Settings.

The following information is listed for each entry:

Remote Address - the address of the remote system

Time - the date and time when the packet was intercepted

When traffic is allowed, the icon is flashed with a green box: . When it is blocked, the icon is flashed with a red box: .

See Also

Activity Tree, Identification,  Identification Settings


Detail: ICMP
Detail on "ICMP"

When "ICMP" is highlighed in the Activity Tree, any recent ICMP communication is listed in the Details Window, if logging is selected under System ICMP Settings.

The following information is listed for each entry:

Remote Address - the address of the remote system

Type - the type field from the ICMP header. Click here for more information.

Code - the type field from the ICMP header (not yet implemented).

Size - the size of the ICMP packet (not yet implemented).

Time - the date and time when the packet was intercepted

When traffic is allowed, the icon is flashed with a green box: . When it is blocked, the icon is flashed with a red box: .

See Also

Activity Tree, ICMP,  ICMP Settings


Detail: ARP
Detail on "ARP"

When "ARP" is highlighed in the Activity Tree, any recent ARP communication is listed in the Details Window, if logging is selected under System ARP Settings. Information is listed in columns, and the list may be sorted (in ascending order) by any column by clicking on the column's header.

The following information is listed for each entry:

Remote Address - the address of the remote system

Remote Ethernet Address - the Ethernet address of the remote system

Time - the date and time when the packet was intercepted

When traffic is allowed, the icon is flashed with a green box: . When it is blocked, the icon is flashed with a red box: .

See Also

Activity Tree, ARP,  ARP Settings


Detail: DHCP
Detail on "DHCP"

When "DHCP" is highlighed in the Activity Tree, any recent DHCP communication is listed in the Details Window, if logging is selected under System DHCP Settings. Information is listed in columns, and the list may be sorted (in ascending order) by any column by clicking on the column's header.

The following information is listed for each entry:

Local Address - the address of your system

Remote Address - the address of the remote system

Time - the date and time when the packet was intercepted

When traffic is allowed, the icon is flashed with a green box: . When it is blocked, the icon is flashed with a red box: .

See Also

Activity Tree, DHCP,  DHCP Settings


Detail: Other IP protocols
Detail on "Other IP protocols"

When " Other IP protocols" is highlighed in the Activity Tree, any recent IP communication other than TCP, UDP or ICMP traffic is listed in the Details Window, if logging is selected under System "Other" Settings. While a beep alerts the user of most System activity (when Reporting is selected), no beep is made to mark "Other IP" traffic.

Since McAfee Firewall does not filter these IP protocols (other than ARP), it does not record or display protocol-specific packet information.

The following information is listed for each entry:

Remote Address - the address of the remote system

Protocol - the IP protocol number (e.g. TCP is #6, GRE is #47)

Time - the date and time when the packet was intercepted

Details - the name of the protocol (for the most common IP protocols)

When traffic is allowed, the icon is flashed with a green box: . When it is blocked, the icon is flashed with a red box: .

See Also

Activity Tree,  Other IP Protocol Settings


Detail: Non-IP protocols
Detail on "Non-IP protocols"

When "Non-IP protocols" is highlighed in the Activity Tree, any recent non-IP communication is listed in the Details Window, if logging is selected under System "Other" Settings. While a beep alerts the user of most System activity (when Reporting is selected), no beep is made to mark non-IP traffic. This is because every packet is logged and traffic may be heavy at times.

Since McAfee Firewall does not filter non-IP protocols (other than ARP), it does not record or display packet information.  Only the date and time is listed as shown in the figure above.

When traffic is allowed, the icon is flashed with a green box: . When it is blocked, the icon is flashed with a red box: .

See Also

Activity Tree,  Non-IP Protocol Settings


Detail: Unknown Traffic
Detail on "Unknown Traffic"

When "Unknown Traffic" is highlighed in the Activity Tree, any unexpected traffic is shown in the Details Window. The list is limited to the most recent 10 entries. Entries are displayed and are not cleared automatically. All packets are recorded in the log.

Occasionally, application related packets will appear in this list, if a connection or DNS server is slow.

See Also

Activity Tree, What is "Unknown Traffic"?


Detail: Current Activity
Detail on "Current Activity"

When "Current Activity" is highlighed in the Activity Tree, the current application sessions are listed in the Details Window. Information is listed in columns, and the list may be sorted (in ascending order) by any column by clicking on the column's header.

The following information is listed for each session:

Application - the application that created the session. The application's icon is used to help you recognize it. If an application is blocked, the icon [image] is used to indicate this.

Local Port - the local port used.

Remote Address - the address of the remote system.

Remote Port - the remote port used.

Start Time - the date and time when the session was started.

Duration - the time, in seconds, that the session has been open.

Sent (Bytes) - the number of bytes sent.

Received (Bytes) - the number of bytes received.

Sent Rate - the (averaged) number of bytes sent per second.

Received - the (averaged) number of bytes received per second.

When traffic is sent or received by a session, the corresponding icon is flashed, if "Show Send and Receive" is selected. In the figure at the top, the third entry shows a session opened by Netscape sending data. Click here for more information on the icon flash.

See Also

Activity Tree, Icons Description


Detail: Activity Log
Detail on "Activity Log"

When "Activity Log" is highlighed in the Activity Tree, the most recently closed sessions are listed in the Details Window. The list is limited to 100 entries. Information is listed in columns, and the list may be sorted (in ascending order) by any column by clicking on the column's header.

The following information is listed for each session:

Application - the application that created the session. Either the generic icon [image] is used, to show the traffic was allowed, or the icon [image] is used to show it was blocked.

Local Port - the local port used.

Remote Address - the address of the remote system.

Remote Port - the remote port used.

Start Time - the date and time when the session was started.

Duration - the time, in seconds, that the session was open.

Sent (Bytes) - the number of bytes sent.

Received (Bytes) - the number of bytes received.

See Also

Activity Tree


ICMP Types

ICMP types are:

 0 - Echo Reply (ping reply)

 3 - Destination Unreachable (the most abused)

 4 - Source Quench

 5 - Redirect

 8 - Echo Request (ping request)

 9 - Router Advertisement

10 - Router Solicitation

11 - Time Exceeded (used by Traceroute)

12 - Parameter Problem

13 - Timestamp Request

14 - Timestamp Reply

15 - Information Request

16 - Information Reply

17 - Address Mask Request

18 - Address Mask Reply

Type 3 is the most often abused, because it tell a system that another system is unreachable, causing the first one to drop its existing connections.


BRKill
BRKill - an attack program that exploits a security weakness in the behaviour of Microsoft's implementation of TCP/IP. Starting with your IP address and a good guess of a TCP connection you have running (particularly easy when on IRC or using PPTP), the attack finds the TCP packet sequence numbers and then attempts to close the connection by spoofing a "disconnect" packet.


Properties: RIP
RIP settings

RIP is a method of updating routing information for large networks. It is used by some ISPs.

RIP is disallowed by default. If your network/ISP uses it, you should allow it.

See Also

RIP Subtree


Reference: RIP
RIP Subtree

The RIP subtree, shown under System,  is where RIP activity is shown. If logging is selected, the icon will flash with either a green box or red, depending on whether the packet was allowed or blocked.

See Also

RIP Settings


Detail: RIP
Detail on "RIP"

When "RIP" is highlighed in the Activity Tree, any recent RIP communication is listed in the Details Window, if logging is selected under System RIP Settings. Information is listed in columns, and the list may be sorted (in ascending order) by any column by clicking on the column's header.

The following information is listed for each entry:

Remote Address - the address of the remote system

Time - the date and time when the packet was intercepted

When traffic is allowed, the icon is flashed with a green box: . When it is blocked, the icon is flashed with a red box: .

See Also

Activity Tree, RIP,  RIP Settings


Menu: Display
Display Menu Item

Minimize to SysTray - When this item is selected (a check mark will be shown to the left of it), the window (shown above) minimizes to the System Tray (at the bottom-right of the screen) when you click on the '_' in the top-right of the program window. Otherwise, it minimizes to the Task Bar, which runs across the bottom, in the middle (to the left of the System Tray).

Start in SysTray - When this item is selected (a check mark will be shown to the left of it), the program starts with the icon in the System Tray. Otherwise, it starts with the window shown above.


Group Box: Logging
Logging Option

The "Logging" option controls one aspect of how McAfee Firewall logs network activity.

Log Unknown Traffic - when selected, an entry is made in the log file for every data packet that was not related to either an application or a known system function. An exception to this is non-IP packets and IP packets other than TCP, UDP and ICMP. No log entries are made for these.

This option is provided for two reasons. Firstly, because some network (such as cable modem connections and large internal networks) have a lot of broadcasts that a system would receive and these are not of interest to the user. Secondly, if every data packet created a log entry, an attacker could flood your system with many small packets and fill your log file. By giving the option to not log this traffic, the log file is kept to a managable

size.

NOTE: if you do not log unknown traffic, you do not have a record of an attack.

Record Application Traffic - when selected, all data sent and received by running applications is logged. The files are (currently) created in the root directory (e.g. C:\) of the drive in use and are named (port)_(Ref#).log, where 'port' the remote port number used, or 0, and 'Ref #' is the reference number that corresponds to the reference number used in log entries.

This feature is useful for examining the data that applications send. If you download a new application and want to see what it is sending out of your computer, you may want to use this feature to check.

NOTE: This feature can use up a lot of disk space very rapidly. Do not use it without monitoring the free disk space on your disk drive.

See Also

Logging


When do I choose "Uninstall CPD`s Network Component"?
When do I choose "Uninstall CPD's Network Component"?

Before you reinstall Windows. This is sufficient, although it is even safer to just uninstall CPD and reinstall it afterwards.

Uninstalling the Network Component is not needed during normal operation. It is supplied to help with troubleshooting, in case there is a conflict with McAfee Firewall and your system setup.

When McAfee Firewall is not running, it is not filtering or blocking traffic as you have it configured to do when it is running. There is a component that is still installed in your sytem which allows CPD to be immediately aware of applications you are running which are communicating over a network device. If this component cannot install properly on your system, traffic may be blocked when CPD is not running.

If you choose "Uninstall CPD's Network Component" and CPD is not running, then the program is completely inactive and is not interfering with network traffic. You can run this operation as often as you want. CPD will reinstall its network component automatically when it is run again. This network component is removed as part of CPD's uninstall, so you don't have to run this operation if you uninstall.


Configuration: Applications
Configuring Applications

The following steps will help the Administrator set up the Applications portion of the configuration. While the configuration file (CPD.SFR) is not intended to be transferrable, the Applications settings can be successfully copied from one system to another. The System settings cannot.

1) Select the Settings menu item, and the Applications option on the popup menu.

2) Do not select "Trust all applications" unless you are very sure this is what you want. When selected as shown here: , all applications are freely allowed to communicate and malicious "trojans" may go unnoticed.

3) Close the Application Settings dialog box, choosing "OK".

4) Add applications you want to communicate to the "Trusted Applications" list by running the application. You will be prompted to allow the application. Choose 'Yes'.

5) Once you have run the applications you want to communicate, review the Trusted and Blocked Applications lists by choosing Applications/Settings again, as in Step (1).

6) If an application is in the wrong list, choose either the [image] to move it to the "Blocked" list or [image] to move it to the "Trusted" list. If you do not want an application in either list, choose [image] to remove it from the "Blocked list, or [image] to remove it from the "Trusted" list.

7) Choose "OK" to close the dialog box.

8) Choose File/Save Settings if you want to write this new configuration to disk immediately. Note: the configuration is automatically written to disk when you exit McAfee Firewall.

See Also

Application Settings and Display


Configuration: System
Configuring System Settings

The following steps will help the Administrator set up the System portion of the configuration. While the configuration file (CPD.SFR) is not intended to be transferrable, the Applications settings can be successfully copied from one system to another. The System settings cannot. This is because different systems have different network devices and it is uncommon to find two that are the same.

1) List all the network segments that are connected to computers that are to be configured.

Include internal networks and any connection to an external network (e.g. the Internet) even if it is by modem. This is often a simple task, since most computers have just one or two network connections.

2) Decide what network traffic should be allowed on each network segment.

3) Select the Settings menu item, and the System option on the popup menu.

4) From the list of network devices, determine which device is connected to which network segment you listed in Step (1). If you have one modem but see two "Dial-Up Adapter" entries, one of them may be a Microsoft Virtual Private Network Adapter. Usually, the entry with the lower device number (e.g. [0000]) is the physical device and the other is the virtual device.

5) For each device:

5.1) Highlight the device in the list and select Properties.

5.2) According to the policies you defined in Step (2) above, allow or block the different types of network traffic.

5.3) Choose OK when done. Note: changes take effect for this device when you choose OK on the Properties page. Choosing Cancel on the System/Settings page does not cancel these changes. If in doubt, review the settings later to confirm.

6) Choose OK to close the System/Settings dialog box.

NOTE: you must check System Settings after adding or removing network devices.

See Also

Configuration after Adding/Removing Network Devices, System Settings and Display


Configuration: After Adding/Removing Network Devices
Configuration after Adding/Removing Network Devices

The System Settings must be verified after changes are made to network devices. This is especially important if a network device is added or removed. If a device was removed, all settings may have to be re-entered, because they previous settings may now be associated with the wrong device. If a device is added, it will have to be configured for the first time.

1) Select the Settings menu item, and the System option on the popup menu.

2) For each network device:

2.1) Choose the device in the list and choose Properties.

2.2) Confirm that the settings shown are your choice. Makes changes where necessary.

2.3) Choose OK when done. Note: changes take effect for this device when you choose OK on the Properties page. Choosing Cancel on the System/Settings page does not cancel these changes. If in doubt, review the settings later to confirm.

3) Choose OK to close the System/Settings dialog box.

See Also

System Settings and Display, Configuring System Settings


Configuration: Password Protection
 Using Password Protection

The following steps will help the Administrator protect the configuration. Without using password protection, the only way to make sure that setup has not been altered is to examine all settings. By using password protection, you will be notified if the setup file was altered.

1) Select the File menu item, and the "Password" option on the popup menu. This pops up another menu. Select "Set".

2) Enter a secret password in the two places shown and choose OK.

3) Write the password down and store it in a safe place. There is no mechanism for retrieving the password once it is lost.

The next time the program is run, it will prompt for the password to be entered. If it is not entered (you can simply hit the <Esc> key), the control functions are disabled (shown in gray) and the setup cannot be changed. Once the correct password is entered, the control functions  may be used.

 It is really important to choose a password that others will not guess. Choosing words, such as "open sesame" is a poor choice because there are password guessing programs that systematically try every word in the dictionary as well as common phrases, names, dates and other predicatable entries. It is better to choose several unrelated words, letters mixed with numbers, or completely random characters. The more, the better. There are password generation programs that can help you choose. They may help.

 It is better to use a new password every time you make an important configuration change. Every file you create with a password is "valid" in that McAfee Firewall will see that it matches the password you used for it. Using a new password prevents someone from secretly replacing an older configuration file for a newer one.

 Trojans such as BO and Netbus can log keyboard stokes. Therefore, they can log a password as you type it. While McAfee Firewall helps you detect trojans, you must be diligent in keeping them off your computer(s) before they compromise the security systems you put in place.


Configure Network, Display and Logging Controls
Configuring Network, Display and Logging Controls

The Administrator must choose how to set the three sets of visible controls:

Network Control

This should usually be set to "Filter Traffic". If it is set to "Block Everything", the system will not be able to communicate over any network device. If it is set to "Allow Everything", nothing will be blocked. When it is set to "Filter Traffic", it controls network communications according to the Application and System settings.

Display Control

It is best to choose Summary mode when setting it up for other users. The information shown in Detail mode is intended for the Adminstrator and may reduce performance on high-speed networks.

Logging Control

It is important to log unknown traffic if you want to review the log files to look for intrusion attempts. This option should only be unselected if the computer is on a busy network and large amounts of (harmless) traffic fills the log file.

See Also

Network Control Options, Display Options, Logging Option


Reference: Warnings
Warnings

The following warning messages will appear to warn the user of changes to the settings that may be either too restrictive or too permissive. The user can choose not to be warned about this in the future.

The above warning appears when the Network Control setting is changed to "Block Everything".  This is to make sure the user understands that no traffic will be allowed.

The above warning appears when the Network Control setting is changed to "Allow Everything".  This is to make sure the user understands that no traffic will be blocked and they are as unprotected as when McAfee Firewall were not running.

The above warning appears when the user chooses not to allow ARP.  This is to make sure they understand that this will greatly affect all network communications.

See Also

ARP Settings, Network Control Options


 Password Protection

While McAfee Firewall is designed to protect a Windows computer from unwanted network communication, the security it provides can be undermined if the configuration can be altered. This is especially easy on Windows 95 and 98.

This problem is partially addressed by adding password protection to the configuration file. The protection is only partial because only the operating system can provide access control, such as is found in Linux and Unix.

When you use a password to protect your configuration:

•  the settings cannot be changed while McAfee Firewall is running unless the correct password has been entered,

•  tampering of the configuration file will be detected the next time McAfee Firewall is run, if (and when) the password is entered,

•  if the password has not been entered, new networking applications will be blocked automatically.

See Also

Using Password Protection


Properties: PPTP
PPTP Settings

PPTP is used in Microsoft's method of encrypting transmission. It uses both TCP/IP and GRE/IP.

PPTP is disallowed by default. If you use it, you should allow it as well as allowing "Other IP Protocols" to allow the GRE transmissions.

See Also

PPTP Subtree


Reference: PPTP
PPTP Subtree

The PPTP subtree, shown under System,  is where PPTP activity is shown. If logging is selected, the icon will flash with either a green box or red, depending on whether the packet was allowed or blocked.

This subtree shows only the control traffic that is sent in the TCP stream. The data is sent by the GRE protocol and does not appear here on send and receive.

See Also

PPTP Settings


Detail: PPTP
Detail on "PPTP"

When "PPTP" is highlighed in the Activity Tree, any recent PPTP communication is listed in the Details Window, if logging is selected under System PPTP Settings. Information is listed in columns, and the list may be sorted (in ascending order) by any column by clicking on the column's header.

The following information is listed for each entry:

Remote Address - the address of the remote system

Time - the date and time when the packet was intercepted

When traffic is allowed, the icon is flashed with a green box: . When it is blocked, the icon is flashed with a red box: .

See Also

Activity Tree, PPTP,  PPTP Settings


Log File Messages

The typical entries in a log file are described below. The log file entries are shown in bold. The explanation is included below in standard font. NOTE: almost all IP addresses shown below are fictitious.

Starting McAfee Firewall on 1999/03/11 8:12:15 AM

This is the first line written to the log when McAfee Firewall starts. The time is shown in local time.

C:\PROGRAM FILES\MCAFEE\MCAFEE FIREWALL\199903.log

This is the pathname of the log file that is written.

Devices:

Below are listed the logical network devices, using the Operating System's unit number on

Windows 95 and 98 and the logical device name on Windows NT. If you see a message:

Registry information on device 0000 appears to be wrong, Ndis version is = 0.10

The firewall will attempt to open it anyway.

Don't worry. When the driver was installed, the wrong information was written in the Registry. McAfee Firewall will probably open the device correctly.

0000

0002

0001

Attaching to devices:

This documents the opening of the network devices.

MSTCP

"MSTCP" just refers to the name of the TCP protocol driver. This message can be ignored.

0000

0002

0001

The devices are listed again as they are opened. If an error occurs while trying to open a device, it will be shown here.

Ruleset file: C:\Program Files\Mcafee\McAfee Firewall\Firewall.SFR

This is the path name of the configuration file that is used.

System Settings:

Device                                        ARP      DHCP     Identification ICMP     RIP      OtherIP  PPTP     NonIP    Shares(Others) Shares(Mine)

Dial-Up Adapter [0000]          : allowed  blocked  allowed                  3/s    blocked  blocked  blocked  blocked  allowed              blocked

PCI Ethernet Adap..[0002]     : allowed  blocked  allowed           blocked   blocked  blocked  blocked  blocked  allowed              blocked

Dial-Up Adapter [0001]          : allowed  blocked  allowed           blocked   blocked  allowed  allowed  blocked  blocked              blocked

The system settings are logged at startup and whenever they are modified. This is to help interpret the log entries that follow.

sprint

This is the hostname of your system, as returned by the Operating System.

Own IP is 192.139.45.1

Own IP is 10.3.1.184

These are the IP addresses assigned to your computer's network devices.

------------------ McAfee Firewall is running ----------------------

This message indicates McAfee Firewall is fully started.

Sharing \\GRANNY\C-DRIVE as E:

This entry shows I have opened a fileshare, mapping the C: driver on a system called "GRANNY" onto my E: drive. If another system were to connect to my shares, this would be logged as well similarly.

1999/3/11 8:12:39 AM: NETSCAPE.EXE port 1031 (ephemeral) - 10.0.251.142 port 53 (DNS), lasting 1 second(s), 32 bytes sent, 125 bytes received.

An entry like this is written every time an application opens and closes a "session" (TCP connection or UDP communication), if "Detail Display mode" is selected. The information supplied is:

- date and local time of the start of the session (NOTE: session entries are written when the session completes, but the date and time are the start of the session. As a result, the log entries can be out of chronological order, according to their given times).

- application name

- local port number used and the most likely service, if known,

- remote address and domain name, if known,

- remote port number used and the most likely service, if known,

- the duration of the session, in seconds,

- the bytes sent,

- the bytes received

1999/3/11 8:12:45 AM: NETSCAPE.EXE port 1034 (ephemeral) - 10.0.251.143 (pop3.isp.com) port 110 (Email), lasting 3 second(s), 54 bytes sent, 2316 bytes received.

In the above entry, Netscape opened a connection at 1999/3/11 8:12:45 AM, local time, used local port 1034 to make a connection to "pop3.isp.com", whose IP address is 10.0.251.143 (a fictional name and number), used POP3 (port 110) to download email and did it in 3 seconds. 54 bytes were sent to request the email and the email was received in 2316 bytes. (NOTE: the number of bytes sent and received will be less than the byte count at the network level because this count is the data sent within network packets, not the whole packet size, etc.)

1999/3/11 8:13:22 AM: EUDORA.EXE port 1036 (ephemeral) - 10.1.46.3 port 110 (Email), lasting 71 second(s), 428 bytes sent, 90105 bytes received.

In the above entry, Eudora was used to send and receive email from another email server.

1999/3/11 8:12:23 AM: MCAFEE.EXE port 4995 (ephemeral) - 10.2.76.42 port 4996 (ephemeral), lasting 273 second(s), 12560 bytes sent, 105840 bytes received.

In the above entry, McAfee Firewall’s VPN client, McAfee.EXE, made a tunnel connection to the VPN server. From the byte count, you can surmise that Eudora accessed the email server because of the VPN link.

1999/3/11 8:38:40 AM: NETSCAPE.EXE port 1076 (ephemeral) - 12.6.233.29 (www.vireo.com) port 80 (WWW), lasting 3 second(s), 170 bytes sent, 10308 bytes received.

In the above entry, Netscape was used to visit the www.vireo.com Web site (in order to answer a question posted in a newsgroup - see the entry below).

1999/3/11 8:12:45 AM: NETSCAPE.EXE port 1035 (ephemeral) - 10.1.251.144 (news.isp.com) port 119 (News), lasting 1708 second(s), 421 bytes sent, 21791 bytes received.

In the above entry, Netscape was used to check postings in the  newsgroups. Note the entry, dated 8:12:45 AM follows the WWW entry at 8:30:40 AM. This is because the session was closed later. Entries are written when the session is closed.

1999/03/18 8:51:12 AM: Dial-Up Adapter [0000][Ref# 0] Blocking incoming UDP: src=111.222.6.2, dst=10.3.1.184, sport=1388, dport=31337.

In the above entry, a remote system tried to send a UDP packet to my port 31337. This is used by the trojan BO and should be taken very seriously. Another trojan is called Netbus and it tries to reach your TCP port 12345. The "Ref# 0" means the traffic does not correspond to any system setting or application activity - it is "Unknown Traffic".

Last message repeated 2 more times.

The above entry indicates the event in the earlier log entry (at 8:51:12 AM) occurred two more times. Repeated messages are summarized like this for brevity.

------------------ McAfee Firewall is stopping ----------------------

This message indicates McAfee Firewall is being stopped.

Stopping McAfee Firewall on 1999/03/11 9:07:35 AM

This message indicates the time at which McAfee Firewall was stopped


Menu: Fragmented Packets
Fragmented Packets Menu Item

Fragmented packets are used in many network attacks, so they are made controllable by the user. By default they are blocked without logging. The user may allow them or choose to log blocked fragments.

Windows 95 is vulnerable to fragment attacks, but patches are available from Microsoft. Windows 98 and Windows NT 4.0+ are also vulnerable to IGMP fragment attacks, but patches are available from Microsoft.

Block Incoming Fragments - When this toggle is selected (as shown in the figure), fragmented TCP, UDP and ICMP packets will be blocked.

Log Blocked Fragments - When this toggle is selected (not selected in the figure above), blocked fragments are logged in the log file.


Menu: Log File
 Log File: Setting the Path and Size

This option is available under the Settings/Log File menu item.

You can set the directory path in which the log file will be written. Also, you can set the maximum log file size, after which normal log entries are suppressed.

Path: Type the directory path where you want the log files to be written. The program will prompt you and ask if you want to start writing the log there immediately.

Size: Enter the log file size limit in megabytes (1MB = 1,000,000 bytes). The default log file limit is 5 MB but the (monthly) log can fill up quickly depending on the type of network connection you have.


Using with PPP over Ethernet (PPPoE)

McAfee Firewall will work with PPPoE when configured as follows:

1) "Non-IP protocols" must be allowed for both the physical device (the network card) and the logical device. For Bell's Sympatico HSE customers (who use NTS software), the logical device is called "Sympatico High Speed Edition Adapter (NTSPPP3)" and can be found in the Network applet shown in the Control Panel. The Control Panel is found by clicking the "Start" button then "Settings".

Click here for help on allowing non-IP protocols. If non-IP protocols are not allowed, the connection will be lost and the computer may stop responding, requiring a reboot.

2) Connect to your ISP. For Sympatico HSE customers, this is done using "Access Manager" and clicking the "Connect" button. Wait the connection is made.

3) Start McAfee Firewall. If it is started before the connection is made to the ISP, problems may develop and the computer may "freeze", requiring a reboot.

4) Stop McAfee Firewall before disconnecting from your ISP.


Buddha

This picture indicates comments

that remind you not to worry.


PPPoE
PPPoE - PPP over Ethernet


What`s New
What`s New In This Version?

•	Added automatic recognition of virtual adapters, including PGPnet, ICS, PPTP, PPPoE (Sympatico's HSE and WinPoET), SecuRemote and Extranet.

•	Added popup message telling trial users when their license expires (warning starts 5 days before expiry).

•	Suppression of a false error in the log file:

•	Packet32: PacketOpenAdapter Could not open adapter

•	Fixed System Tray menu items for Block, Filter and Allow.

•	Fixed bug that, under certain circumstances, would block traffic

•	for up to 8 seconds when a new IP address was assigned.

•	Fixed a bug in v2.04 that prevented VPN's from connecting.

•	Added a warning about using the "Record Application Traffic" option,

•	since it can use a lot of disk space very quickly.

•	Log file is closed when idle.

•	Log file will automatically open a new file at the start of the month (as soon as logging is idle for a few seconds).

•	Individual control of  IP protocols. In previous versions, all IP protocols other than TCP, UDP and ICMP were either allowed or blocked entirely.

•	Saves the position of the window divider on exit.

•	Display menu item let's the "Minimize" button  '_' mimize to the System Tray, if you choose.

•	Log file size and directory can be set (see File menu).

•	Fixed the automatic start of the icon in the System Tray.


Before you reinstall Windows

We strongly advise you to uninstall CPD before reinstalling or upgrading Windows and then reinstall it afterwards. The reason is that CPD's installation involves an LSP (Layered Service Provider) that can become misconfigured during reinstallation and possibly upgrades as well. If it becomes misconfigured, most network access will become impossible.

If you suspect Windows does not have the LSP configured properly on your computer, uninstall CPD and reinstall it.


Advanced Topics

The following are topics that contain information on network attacks as well as different kinds of ports that Internet Service Providers (ISPs) use.

•	About Network attacks

•	About Ports


Network Attacks

Malicious people who often use hidden or modified IP addresses (i.e., spoofing) and names to hide themselves and get others into trouble launch network attacks. Often these attacks crash desktop PCs with the infamous "blue screen of death," which must then be rebooted. Print and file shares are at risk the minute a desktop is connected to a network (e.g., the Internet), allowing hackers access to data and to system commands (possibly wiping it all out as you watch helplessly).

Listed below are some of the most common attacks.

ATTACK NAME	SYMPTOMS	DESCRIPTION	NOTES
Boink (similar to	System seizure	Bad fragment attack
Bonk, Teardrop and New Tear/Tear2), a		Sends bad packet
hack			fragments that cannot be
			correctly reassembled,
			causing the system to fail
DoS (Denial of	Lack of access to	Denial of Service attacks tie up system resources	Examples include floods (which soak up bandwidth and CPU) and disconnects (which prevent you from reaching hosts or networks)
Service)	resources and	doing things you do not want so you cannot get service
	services
Floods (Nukes),	n/a	Large amounts of ICMP (usually) or UDP useless packets	Ties up system by making it respond to floods of useless garbage
a DoS attack
ICMP flooding	Loss of bandwidth	A flood of ICMP (ping) requests that tie your system in knots responding to garbage traffic. This is analogous to wasting your time answering the door to never-ending doorbells that do nothing.	Ties up CPU time and wastes your bandwidth with the garbage traffic. For
(flood ping), a	(slow responses		example, "Pingexploit" typically attacks Unix systems with oversized ICMP packet fragments.
DoS attack	from the Internet)
	and poor response
	time on the desktop
Identification	Loss of bandwidth	Similar to an ICMP flood, but requests information from your system (TCP	Very often slows the CPU down (even more than an ICMP flood) since identification responses take more time than ICMP responses to generate
flooding (Identd),	(slow responses	port 113)
a DoS attack	from the Internet)
	and poor response
	time on the desktop
Jolt (SSping,	System seizure	Oversized, fragmented	System stops working and
IceNuke), a		packet which causes the system to seize up	must be rebooted
hack
Land, a hack	System seizure	Spoofing attempt which establishes TCP/IP connection to you from you. This SYN request	The attacked system attempts to connect to itself and seizes up
	forcing cold reboot	forces the system to connect to itself, thereby
		locking itself up.
Hack	N/A	An application or a	Varied results. Examples include smurf, teardrop,
		packet that exploits a weakness in operating system, application or protocol	land, newtear, puke, ssping, jolt, etc.
Pong, a hack	Loss of bandwidth	Flood of spoofed ICMP packets, usually changing the spoofed source address with every packet	Reboot to solve
	(slow responses
	from the Internet)
	and poor response
	time on the desktop
Puke, a hack	Disconnection from	Spoofs an ICMP	Usually preceded by an ICMP port scan where "pings" are sent to a system to find a vulnerable port being used to connect to a server
	a server (usually	unreachable error to a target. This forces a disconnect from a
	IRC)	server.
Scan, a generic	System slows	A progressive,	Usually used prior to a hack to find a vulnerable attack spot. This is considered a brutish form
technique and a		systematic testing of ports for an "opening." This attack can chew	of attack and is not as effective as other floods for tying up resources. It usually precedes a more "elegant" attack form.
DoS attack		into system resources since its target is usually changing. It often requires a proper firewall or large, multi-port block to prevent.
Smurf, a hack	A very effective CPU crushing flood-like attack. Apparent system seizure.	Spoofs ICMP packets requesting a response and triggering multiple	A form of flood that is very dangerous since it can get a "many-for-one" effect, tying up lots of CPU cycles for relatively few packets sent
		responses
Spoofing	N/A	An attack masking style that makes traffic appear to come from a legitimate target or that attempts to frame innocent bystanders for attacks for which they are not responsible	Particularly nasty attack because hacks, floods and
			nukes are illegal in most countries and subject to
(IPspoof)			prosecution
unreachable	"Destination		There are 2 forms of this—client unreachable and server unreachable.
(dest_unreach,	Unreachable"		The server unreachable attack sends an ICMP message to the system fooling it into thinking its
Click)- a DoS	messages and		traffic can no longer reach the server, so it gives up. The client unreachable form does the same thing to the server with respect to your system.
attack	disconnection from a server
WinNuke, a hack and a DoS attack, but not a flood	Loss of networking	Sends OOB (Out-of-Band) data to port 139 and exploits Win 3.11, Win95, Win NT 3.51 and Win NT 4.0 systems	Does not crash the system, but it causes a fatal exception requiring a reboot to regain TCP/IP (Internet) connectivity
	resources


Ports

Ports that an Internet Service Providers (ISP) commonly use.

Internet Service(s)	UDP Port	TCP Port
HTTP		80
HTTPS		443
SMTP		25
POP3		110
FTP		20-21
TELNET		23
REALAUDIO		1090
ICQ	4000
NEWS SERVERS		119
DNS	53
IRC		6667
VDOLIVE		7000

Open Service Ports for Windows NT, Terminal Server, & Exchange Server

Functionality	UDP	TCP	IP
Browsing	137, 138
DHCP Lease	67, 68
DHCP Manager		135
DNS Administration		139
DNS Resolution	53
Exchange Administrator		135
Exchange Client/Server Comm.		135
File Sharing		139
IMAP		143
LDAP		389
LDAP (SSL)		636
Logon Sequence	137, 138	139
MTA - X.400 over TCP/IP		102
NetLogon	138
NT Diagnostics		139
NT Directory Replication	138	139
NT Event Viewer		139
NT Performance Monitor		139
NT Registry Editor		139
NT Secure Channel	137, 138	139
NT Server Manager		139
NT Trusts	137, 138	139
NT User Manager		139
Pass Through Validation	137, 138	139
POP3		110
PPTP		1723	47
Printing	137, 138	139
RPC	135	135
SMTP		25
WINS Manager		135
WINS Registration		137
WINS Replication		42

Ports Used by Known Trojans

A "trojan horse" or "trojan" is a program that pretends to be or do one thing, but in reality is damaging your data or sniffing your system for personal data. Back Orifice is probably the most widely known of these. Following is a list of some trojans and the port numbers that they use. This information is useful when examining your log file to determine if an attempt has been made on your system.

Trojan Name(s)	UDP Port	TCP Port
Blade Runner, Doly Trojan, Fore, Invisible FTP, WebEx, WinCrash, FTP Trojan		21
Tiny Telnet Server		23
Antigen, Email Password Sender, Haebu Coceda, Shtrilitz Stealth, Terminator, WinPC, WinSpy, Kuang2, ProMail Trojan		25
Hackers Paradise, Agent 31, Masters Paradise		31
DeepThroat		41
DMSetup		58
Firehotcker		79
Executor		80
ProMail Trojan		110
JammerKillah		121
TCP Wrappers		421
Hackers Paradise		456
Rasmin		531
Ini-Killer, Phase Zero, Stealth Spy		555
Satanz Backdoor, Attack FTP		666
Dark Shadow		911
DeepThroat		999
Silencer, WebEx		1001
Doly Trojan		1011
Doly Trojan		1012
NetSpy		1024
Rasmin		1045
Xtreme		1090
Psyber Stream Server, Voice		1170
Ultors Trojan		1234
BackDoor-G, SubSeven		1243
VooDoo Doll		1245
BO DLL	1349
FTP99CMP		1492
Shivka-Burka		1600
SpySender		1807
Shockrave		1981
BackDoor		1999
Trojan Cow		2001
Ripper		2023
Bugs		2115
Deep Throat, The Invasor		2140
Striker		2565
WinCrash		2583
Phineas Phucker		2801
WinCrash		3024
Masters Paradise		3129
Deep Throat, The Invasor		3150
Portal of Doom		3700
WinCrash		4092
File Nail		4567
ICQ Trojan		4590
Sockets de Troie, Bubbel, Back Door Setup		5000
Sockets de Troie, Back Door Setup		5001
Firehotcker		5321
Blade Runner		5400
Blade Runner		5401
Blade Runner		5402
ServeMe		5555
BO Facil		5556
BO Facil		5557
Robo-Hack		5569
WinCrash		5742
The Thing		6400
DeepThroat		6670
DeepThroat		6771
BackDoor-G, SubSeven		6776
Indoctrination		6939
GateCrasher, Priority		6969
Remote Grab		7000
NetMonitor		7300
NetMonitor		7301
NetMonitor		7306
NetMonitor		7307
NetMonitor		7308
ICKiller, BackDoor Setup		7789
Portal of Doom		9872
Portal of Doom		9873
Portal of Doom		9874
Portal of Doom		9875
iNi-Killer		9989
Portal of Doom		10067
Portal of Doom		10167
Acid Shivers		10520
Coma		10607
Senna Spy		11000
Progenic trojan		11223
Hack'99 KeyLogger		12223
GabanBus, NetBus, Pie Bill Gates, X-bill		12345
GabanBus, NetBus, X-bill		12346
Whack-a-mole		12361
Whack-a-mole		12362
WhackJob		12631
Senna Spy		13000
Priority		16969
Millennium		20001
NetBus 2 Pro		20034
GirlFriend		21544
Prosiak		22222
Evil FTP, Ugly FTP		23456
Delta	26274
SubSeven (new)		27374
The Unexplained	29891
AOL Trojan		30029
NetSphere		30100
NetSphere		30101
NetSphere		30102
Sockets de Troie		30303
Back Orifice Client, Baron Night, B02, Bo Facil		31337
BackFire, Back Orifice, DeepBO	31337
NetSpy DK		31338
Back Orifice, DeepBO	31338
NetSpy DK		31339
BOWhack		31666
Prosiak		33333
BigGluck, TN		34324
The Spy		40412
Masters Paradise, Agent 40421		40421
Masters Paradise		40422
Masters Paradise		40423
Masters Paradise		40426
Delta	47262
Sockets de Troie		50505
Fore		50766
Remote Windows Shutdown		53001
School Bus		54321
DeepThroat		60000
Telecommando		61466
Devil		65000