Welcome

Welcome to Sygate Personal Firewall ™ 4.0

A New Standard in Personal Computer Security

Thank you for choosing Sygate® Personal Firewall ™ 4.0 for your computing security. This might be your first time using a firewall for computer security. If so, we recommend that you read our Introduction.

If you already use an older version of Sygate® Personal Firewall ™ (formerly Sybergen Secure Desktop) or are well-acquainted with firewall usage, you can cruise right through the Table of Contents to find the function or feature you are looking for. It never hurts though, to browse the Introduction, just in case there are some new features you can utilize, or configurations you need to know about.

Remember, we at Sygate® Technologies, Inc. are here to help you. If you have any questions or feedback on the use or contents of this Help file, please feel free to e-mail the author at [image] documentation@sygate.com. More detailed documentation of this product and its functionality is available at www.sygate.com.

If you have any questions or concerns about the use of Sygate® Personal Firewall ™ 4.0 or any of its components, e-mail [image] support@sygate.com, and our technical support team will get in touch with you as soon as possible.

Sygate® Personal Firewall ™ 4.0 offers unparalleled protection against malicious intrusion attempts by hackers, script kiddies, and cracks. With the combined power of bi-directional intrusion detection, vulnerability assessment, and extensive logging and forensics capabilities, you can't find a better protection package.


Introduction

Introduction to Personal Firewall ™ 4.0 Usage

System Tray Icon

The first thing you might notice after installing Sygate® Personal Firewall ™ 4.0 is the icon that appears in the system tray of your task bar. This icon indicates the status of your system traffic, including what traffic, if any, is being blocked by the firewall.

More about the System Tray Icon

Main Console

Sygate® Personal Firewall ™ 4.0 has a simple, straight-forward main console that gives constant updates on your system traffic. You can configure and manage your system's security from the main screen with a few simple key strokes.

More about the Main Console

Logs

One of the most effective ways to defend your computer against intruders is to know your history - your system history. Sygate® Personal Firewall ™ 4.0 constantly monitors all system traffic on your computer, including Internet activity, the starting and stopping of applications and services, and much more. These activities, from the most benign to the potentially malicious, are recorded in four specialized logs. Within the Traffic and Security Logs, you have the ability to back trace system activity.

More about Logs

Applications List

The Applications List displays a panel of all applications that have attempted to access your network since you installed Sygate® Personal Firewall ™ 4.0. You can determine the accessibility status of individual applications from the Applications List.

More about the Applications List

Options... Window

The Options... window offers multiple configuration options, including e-mail notification of hacking attempts, log management, network neighborhood rights assignment, and more...

More about Options...

Vulnerability Assessment

Testing the strength of your firewall is a good was to feel assured that your firewall is protecting you and your computer from malicious intruders.

More about Testing your firewall


Registration

Registering Sygate® Personal Firewall™ 4.0

To Register Sygate® Personal Firewall™ for Personal Use

To Register Sygate® Personal Firewall™ for Business Use

After your have completed installing, Sygate® Personal Firewall™ you will be prompted to register your installation. You can register Sygate® Personal Firewall™ immediately or select to register it later.

To access the registration form at any time, open the Help menu and select Register....

To Register for Personal Use

  1. To register Sygate® Personal Firewall™ 4.0 for personal use, click the Personal Use dial at the top of the window.

  2. Then fill in the appropriate information in the fields provided on the Registration window.

  3. Make sure to enter a valid e-mail address to ensure that you can receive email support from Sygate® Technologies, Inc.

  4. Make sure that you can connect to the Internet. Click Register Now.

To Register for Business Use

Business users must purchase Sygate® Personal Firewall™ from the Sygate® Technologies web site at http://www.sygate.com in order to properly register it.

If you have already purchased Sygate® Personal Firewall™, and have the serial number and registration code available, you may register the product.

  1. First, click the Business Use dial at the top of the Registration window.

  2. Enter the appropriate information in the fields provided.

  3. Make sure that you can connect to the Internet. Click Register Now.


Why Did I Get a Pop-up Message?

Pop-up messages will occur for several reasons. Security-related pop-ups are the most common types of alert message in Sygate® Personal Firewall™ 4.0. The three security alerts that you will see most often can occur for one of three reasons:

  • New Application Pop-up: An application that Sygate® Personal Firewall™ 4.0 has never seen before, or that has been assigned the status of Ask, is trying to access your network connection.

  • Changed Application Pop-up: A trusted application (an application with a status of Allow) is trying to access your network, and does not pass the Sygate Personal Firewall 4.0 digital signature test.

  • Trojan Horse Warning: Sygate® Personal Firewall™ 4.0 has detected a Trojan horse on your computer.


New Application Pop-up

In the beginning, it might be common for you to see the following pop-up message:

What does this mean? Well, it means that Microsoft Internet Explorer is trying to access your network connection, and is attempting to connect to the web site scan.sygatetech.com., which has an IP address of 207.33.111.332, at that site’s server port 80. That’s plenty of information to take in.

Basically, it means that Microsoft Internet Explorer has been opened, either directly by you, indirectly by you, or by another application.

You might have tried to open Internet Explorer. Either this is the first time that you have done so since you installed Sygate® Personal Firewall™ 4.0, or you have assigned Internet Explorer a status of “Ask”, meaning that every time Internet Explorer tries to access your network connection, Sygate® Personal Firewall™ 4.0 will ask you for permission to grant it access .

What if you did not directly try to open Internet Explorer? Perhaps you clicked on a link to a web site, or tried to open another program that might use Internet Explorer. You might have clicked the Test button on the Sygate® Personal Firewall™ 4.0 main console. If so, your computer will try to open Internet Explorer for you. In such a case, it is probably safe to click Yes and allow Internet Explorer to access the network.

What if you didn’t open any program or click on any link, and a program suddenly tries to access your network connection? Again, there could be a number of different reasons. However, if you haven’t opened any programs that use the application listed on the pop-up message, or can’t see any reason why that application should try to access your network connection, it is always safest to say No. This might indicate the presence of a Trojan horse on your computer, something that needs to be checked immediately.

Clicking the Details button opens another information field containing further details on the application.

What Should I Do When I Get the New Application Message?

This kind of message is common when you first start using Sygate® Personal Firewall™ 4.0. In this particular example, Microsoft Internet Explorer is trying to access a Sygate® Technologies web site at the remote port 80. Most servers use port 80 to send and receive information on the Internet, so this isn’t anything unusual.

If you believe that you have triggered this application, it would be safe to click Yes. You have the option to tell Sygate® Personal Firewall™ 4.0 to remember the your answer for future reference. If you check the box marked Remember my answer, and do not ask me again for this application, Sygate® Personal Firewall™ 4.0 will remember your choice, and will act accordingly the next time this application tries to access your network connection.

If You Select “Yes”

If you have tried to open an application (such as a web browser) or a program that uses another application to access the Internet (such as a media streaming program) and you feel comfortable granting this application access to your network connection, then you can select Yes.

If You Select “No”

However, if a pop-up message is unexpected, and you can’t see any reason why the listed application should access the network connection, select No. This will assign the application or service a status of Block, so that it will be automatically blocked from your network connection any time it tries to gain access.

You should also run a virus scan to make sure that you have not inadvertently downloaded a virus or a Trojan horse that could infect your computer files.


Changed Application Pop-up

Occasionally, you might see a pop-up such as the one pictured below.

What does this mean? Generally, it means that you have recently upgraded the application pictured on the pop-up. As Sygate® Personal Firewall™ 4.0 uses checksum to determine the legitimacy of an application, an upgraded version might not pass the checksum test, since a new build or new version of the application is likely to have a different checksum value.

On the other hand, if you haven’t upgraded the application recently, and see no reason why this message should appear, this could be an instance of a new Trojan horse trying to access your network.

What Should I Do When I Receive a Changed Application Message?

If you have recently upgraded the application mentioned on the pop-up message, it is probably safe to click Yes and allow the application network access.

However, if you do not think that you have recently upgraded the listed application, you should select No and run an anti-virus software program or, if you are at work, contact you IT department.


Trojan Horse Warning

If Sygate® Personal Firewall™ 4.0 detects a known Trojan horse on your computer, you will be alerted with a message such as the one pictured below.

What Should I Do When I Get a Trojan Horse Warning?

If at work, you should immediately notify your IT department. If you receive the notification on your home computer, you should purchase some anti-virus software. Some companies offer free trial versions of their anti-virus programs.


System Tray Icon

Icon Description

Possible Icon Appearances

Why does my icon look so strange?

How to Hide the System Tray Icon

How to UnHide the System Tray Icon

Once installed, Sygate® Personal Firewall™ 4.0 will display an icon in the system tray of your computer's task bar (the lower-right corner of your computer screen, where the time display is located). This icon indicates the status of the traffic between your computer and any external network(s), including the Internet.

The icon has a dynamic appearance, and if you are actively connected to a local area network or the Internet, the icon will probably be changing its appearance frequently. To see a table of all the possible appearances the icon might have, as well as an explanation for the appearance, see the table below .

There is an easy way to determine the icon's meaning at a glance. Just note the following:

the downward-pointing arrow indicates incoming traffic

the upward-pointing arrow indicates outgoing traffic

If the arrow is BLUE, traffic is flowing in the direction indicated, and has been allowed to do so by Sygate® Personal Firewall™ 4.0.

If the arrow is GREY in color, no traffic is flowing in that direction.

If the arrow is RED, traffic is attempting to flow in the direction indicated, but is being blocked by Sygate® Personal Firewall™ 4.0.

The table below illustrates the different appearances that the icon might have, and what each appearance means.

Icon | Meaning
 | Sygate® Personal Firewall™ 4.0 is in Alert Mode.
 | Incoming traffic has been approved by the firewall; there is no outgoing traffic.
 | Both incoming and outgoing traffic have been approved.
 | Outgoing traffic has been approved by the firewall; there is no incoming traffic.
 | Potential incoming traffic has been blocked by the firewall; outgoing traffic has been approved.
 | Incoming traffic is being blocked by the firewall; there is no outgoing traffic.
 | Both potential incoming and outgoing traffic are being blocked by the firewall.
 | There is no incoming traffic; outgoing traffic is being blocked by the firewall.
 | Incoming traffic has bee approved by the firewall; outgoing traffic has been blocked by the firewall.
 | There is no incoming OR outgoing traffic.

To Hide the System Tray Icon

  • From the Sygate® Personal Firewall™ 4.0 main screen, click the Tools menu. Select Hide System Tray Icon from the list of options.

To UnHide the System Tray Icon

  • From the Sygate® Personal Firewall™ 4.0 main screen, click the Tools menu. Select Show System Tray Icon from the list of options.

Back to the Top


Alert Mode

If your system tray icon takes on an unusual appearance, it may be because Sygate® Personal Firewall™ 4.0 is in Alert Mode.

Every time Sygate® Personal Firewall™ 4.0 records an attack on your computer in the Security Log, the system icon will display the flashing Alert Mode Status icon, as pictured below.

What should I do if the firewall is in Alert Mode?

  1. Don't worry. Simply double-click the System Tray Icon. The Security Log will open to display the logged attack.

  2. If you feel the need to take extra steps to ensure your protection, you can change your security setting to Block All.


Main Console

The main console of Sygate® Personal Firewall™ 4.0 provides constant, real-time updates on your computer's network traffic, application status, and security level. From the main console, you can navigate to anywhere else within the firewall.

Menus

Toolbar

Traffic Flow Graphs

Running Applications List

Status Bar


Menus

Menus run across the top of the Sygate® Personal Firewall™ 4.0 main console, just above the toolbar. Clicking on the menu name will open the drop-down list of options for that menu.

There are five menus in Sygate® Personal Firewall™ 4.0. File, Security, Tools, View, and Help.

File

Security

Tools

View

Help


Toolbar

The Sygate Personal Firewall 4.0 toolbar is located along the top of the main console. Toolbar buttons offer a quick and easy way to open important windows within Sygate Personal Firewall 4.0.


Traffic Flow Graphs

The Traffic Flow Graphs

The Traffic Flow Graphs present a graphical representation of the flow of traffic in and out of your computer through your network connection/modem.

  • The top graph, labeled Incoming Traffic, shows the speed of traffic flowing into your computer that has been passed by Sygate Personal Firewall 4.0.

  • The second graph, labeled Outgoing Traffic, displays the speed of traffic flowing out of your computer that has been passed by Sygate Personal Firewall 4.0.

  • The bottom graph, labeled Blocked Traffic, represents both the Incoming and Outgoing traffic that is being blocked by Sygate Personal Firewall 4.0.


Running Applications List

What is the Running Applications List?

Hiding System Services

Changing Your View in the Running Applications List

The Running Applications list, which is located below the traffic flow graphs, displays all applications and services that are currently accessing (or attempting to access) your network connection. The status of the applications is also displayed:

Icon | Meaning
 | If an application has a status of "Allow", and is accessing your network connection, it is displayed as a normal icon.
 | If an application has a status of "Ask" and is accessing your network connection, it's icon will be displayed with a yellow question mark over it.
 | If an application is being blocked, its icon will be displayed with a red circle and cross mark over it.

You can change the size of the icons and the information displayed within the Running Applications field by right-clicking within the field and selecting the desired view from the list of options provided. Alternately, you can open the view menu at the top of the main console, and select the desired view from the list provided.

Hiding System Services

You may notice a large number of services displayed in the Running Applications field. Although they cannot access your network connection without your permission, since many services are hard-coded into your computer, they show up in the Running Applications field, anyway.

To hide the services from view, place a check in the Hide Windows Services check box above the Running Applications field.

Changing Your View in the Running Applications Field

There are a number of ways in which you can view the applications in the Running Applications field. You can change the view from the View menu on the main console, or by right-clicking inside the Running Applications field and selecting from the following options:

Choice | What You'll See
Large Icons | Large application/service icons representing with the name of the application/service, arranged in horizontal lines
Small Icons | Smaller icons and the application/service names, arranged in horizontal lines
List | Small icons and the application/service name, arranged in a vertical list
Application Details | A vertical list of icons and application/service names, with version and path information
Connection Details | Shows the details of each network connection made by an individual application or service
Hide Windows Services | Checking the box at the top of the Running Applications field will hide system services from being displayed


Status Bar

The Status Bar runs along the bottom of the main console of Sygate® Personal Firewall™ 4.0. It provides information regarding the security level currently being used.


Understanding Security Levels

What's the difference between the security levels?

Block All and Allow All

Switching Security Levels

There are three (3) security levels in Sygate® Personal Firewall ™ 4.0 : Normal, which offers customizable protection, Block All, and Allow All.

The default security level (the level automatically assigned when you start Sygate® Personal Firewall™ 4.0) is Normal.

Security Level | What This Means
Normal | The Normal level is a configurable security setting that automatically blocks any application from your network until you grant it access to your connection. You can alter the "status" of different applications in the Applications List.
Block All | Block All prevents all information entering or leaving your computer from ANY outside source. All network traffic is blocked from entering or leaving your computer.
Allow All | Allow All permits the transmission of ALL network traffic, including the Internet, to and from your computer system via network connections. The Allow All setting still logs all traffic that enters and exits your system.

Block All and Allow All

Block All prevents the transmission of ANY AND ALL network traffic that is attempting to either enter or leave your computer. Allow All effectively disables Sygate® Personal Firewall™ 4.0 protection for both incoming and outgoing traffic, but still logs all traffic movement through your network.

Why would I use Block All and Allow All?

Block All

  • Your system tray icon indicates that Sygate® Personal Firewall is in alert mode.

  • You are leaving your computer unattended.

Allow All

  • You need to run an application that is not compatible with Sygate® Personal Firewall™ 4.0. The Allow All security setting logs all traffic that enters and exits your computer via your network connection.

To Switch Security Levels

To switch from one security level to another, right-click the System Tray Icon, then select the desired security level from the list.

Alternatively, you can open the main screen, click the Security menu, and select the security level from the menu.

To set your security level to Block All, you can click the Block All button on the main console.


Setting Security Levels

Setting Your Security Level

Setting your security level is one of the most important aspects of managing your system's security. Please make sure that you have read the Understanding Security Levels section to determine which level is best for your usage and security needs.

To Set System Security Level

  1. Click on the Security menu at the top of the SPF 4.0 main screen. The menu will drop down.

  2. Select the security level that you have decided on by clicking on it.

To Switch Security Levels

To switch from one security level to another, right-click the system tray icon, then select the desired security level from the list.

Alternatively, you can open the main screen, click the Security menu, and select the security level from the menu.

To set your security level to Block All, you can click the Block All button on the main console.


Understanding the Application List

Understanding the Applications List

Opening the Applications List

Understanding the Applications List

Applying or Changing Access Status

Advanced Application Configuration

The Applications List is a list of all software programs that have attempted to access your network from your computer. This includes any applications that you have allowed or denied access to your network connection. From the applications list, you can change the status of an application. An application's status determines whether or not it can utilize your network at any time. Advanced status settings allow you to specify which port an application can use, or to schedule a time period in which an application can be allowed or denied use of your network connection.

You can access the Applications List by clicking the Applications icon on the toolbar, or by selecting Applications under the Tools menu.

Don't confuse the Applications List (which displays a list of all applications that have attempted contact with your network connection since the installation of SPF 4.0) with the Running Applications field (which shows all the applications that are currently accessing your network connection).

When you open the Applications List, you will find a list of applications that have attempted to access your network connection since the installation of Sygate® Personal Firewall™ 4.0. The list displays each application in a separate row, with additional information in each column. The columns present the following information:

  • FileName - The name of the application.

  • Version - The version (build number) of the application.

  • Access - The access status that you have applied to this program (either Block, Ask, or Allow)

  • Path - The location of the file components on your computer.


Access Status

Applying or Changing an Application Access Status

What is Access Status?

An Access Status is a set of rules that governs how many rights an application has in terms of accessing your network connection or modem. Depending on what status is assigned to an application (or service), and how much configuration you apply to it, an application can either access your network whenever it wants, access your network under certain conditions, access your network with your permission, or be blocked from accessing your network completely.

There are three access statuses in Sygate® Personal Firewall 4.0: Allow, Ask, and Block. An application with a status of Allow will be allowed to access network connections. Under the Allow status, and application (or service) can be configured so that it can only access the network if using a certain port, or during certain hours. An application with a status of Ask requires your permission each time it attempts to access network connections. An application with a status of Block will be blocked from using your network altogether.

When a new application attempts to access your network connection while you are under the default security setting (Normal), Sygate® Personal Firewall will open a pop-up window to ask if you wish to allow the application access to the network. This is because the application has a default access status of Ask. If you haven't allowed it or blocked it, Sygate® Personal Firewall 4.0 is going to ask you about it every time it tries to access your network/modem.

You have several choices when you get the application pop-up message:

  • Select Yes, and tell SPF 4.0 to remember your answer, so that you are not asked in the future. This application will then be allowed to access your network until you change its access status. This gives the application a status of Allow.

  • Select Yes, but do not elect to have SPF 4.0 to remember your answer. Every time this application attempts to use your network connection, you will be asked again if it should be allowed or denied access. This gives the application a status of Ask.

  • Select No, and tell SPF 4.0 to remember your answer, so that you are not asked in the future. This application will then be systematically denied access to your network unless you change its access status. This gives the application a status of Block.

  • Select No, but do not elect to have SPF 4.0 to remember your answer. Every time this application attempts to use your network connection, you will be asked again if it should be allowed or denied access. This gives the application a status of Ask.

If you change your mind about the access status of an application, you can change its status from the Applications List.

To Change the Status of an Application

  1. Open the Applications List.

  2. Click on the FileName of the appropriate application until the row is highlighted.

  3. Using your mouse, right-click on the highlighted row.

  4. Select the appropriate access status (Allow, Ask, or Block) from the list.

  5. Click OK to close the Applications List.


Advanced Application Configuration

Advanced Configuration

Screensaver Mode

Trusted IP Addresses

Trusted Ports

Scheduling

You can configure advanced security settings for each application on your application list by setting certain restrictions on which IPs and Ports an application can utilize.

Advanced Configuration

  1. Open the Applications List by clicking on the Applications icon on the Sygate® Personal Firewall™ 4.0 main console, or by right-clicking the system tray icon and selecting Applications from the list of choices.

  2. Select the name of the application that you wish to configure advanced settings for. Advanced Configuration is application specific, meaning that the configuration settings will only apply to the application selected in the drop-down box at the top of the screen. Make sure the name of the application is highlighted.

  3. Click the Advanced button at the bottom left corner of the Applications List screen. The Advanced Application Configuration window opens.

Screensaver Mode

  4. Place a check mark in the check box to allow network access to the selected application during Screensaver Mode.

Trusted IP Addresses

  5. Enter trusted IPs or IP ranges in the Trusted IPs for Application text box. This IP address or addresses will be trusted for this application. This means that anything arriving from this IP address or address range will be trusted if it is in the form of the above application.

Make sure that you enter a valid IP address. IP address within the following ranges are invalid:

  • 0.0.0.0

  • 255.255.255.255

  • 127.0.0.0 - 127.X.X.X

Trusted Ports

  6. Enter the ports or port range(s), or select the protocol from the drop-down TCP and UDP lists that can be utilized for this application. Only these ports will be used for this application.

  7. Click OK if the application restrictions are to be in effect constantly. If you wish to set a time limit or schedule specific periods when the restrictions will be in effect, see Enable Scheduling below.

Enable Scheduling

You can also set times for which the advanced configurations take effect. You can trust or disable certain IP addresses or address ranges for specific days or for specified time spans. Similarly, you can schedule days or times spans in which certain ports or port ranges will be trusted or blocked.

  1. Check the Enable Scheduling check box below the Ports section on the Advanced Application Configuration screen.

  2. Select either the During the period below or the Excluding the period below dial.

  3. Select a Beginning Month, Day, Hour, and Minutes from the appropriate pull-down boxes.

  4. Enter a duration in units of Days, Hours, and/or Minutes.

  5. Click OK to set restrictions.


Understanding Logs

What is a Log?

Different Types of Logs

Exporting Logs

In Sygate® Personal Firewall™ 4.0, a log is a record of information attempting to enter or exit you computer through your network connection. In SPF 4.0, there are four separate logs that monitor different aspects of your network connection.

Logs are an important method for tracking your computer's activity and interaction with other computers and computer networks. They particularly useful in detecting potentially threatening activity, such as port scanning, that is aimed at your computer.

To view the different logs available in Sygate® Personal Firewall™ 4.0, click on the Logs icon on the toolbar at the top of the main screen.

click icon to view security log [image] [image] [image] OR click down arrow and select log type

There are four different log types in Sygate® Personal Firewall™ 4.0:

  • System Log

  • Security Log

  • Traffic Log

  • Packet Log

Exporting Logs

Logs can be exported and saved in different locations for the purpose of saving space.

  1. To export a log file, open the log in the Log Viewer.

  2. Open the File menu, and select Export....

  3. In the Save As window, select the location for the log file. We recommend giving it an appropriate name, incorporating the date, and type of log file (Security, Traffic, etc.).

  4. Click Save.


Security Log

Opening the Security Log

Reading the Log Information

Back Tracing Hacking Attempts

Filtering Security Event Logs

Viewing the Security Log Events by Date

What is the Security Log?

The Security Log records potentially threatening activity directed towards your computer, such as port scanning, or denial of service attacks.. The Security Log is probably the most important log file in Sygate® Personal Firewall™ 4.0.

Opening the Security Log

  1. There are two ways to open the log file from the SPF 4.0 main console. Choose the one that is most useful for your use.

  • Click the downward-pointing arrow next to the Logs Icon. Select Security Log from the List.

  • Open the Tools menu. Select Logs>Security Log....

  2. The Log Viewer will open in a separate window. Every time a security-threatening activity aimed at your computer is recognized by Sygate® Personal Firewall™ 4.0, it is recorded in the Security Log. The Log Viewer provides a standard list of these logged events. Each event occupies one line on the system log.

Reading the Security Log

Each log opens in the Log Viewer, with logged events arranged on a data sheet for easy identification of log details. Each row on the sheet represents one log event, and the columns provide further information regarding the event. The first column provides the date and time of the event, as well as an icon that offers a graphical representation of the kind of event logged. Clicking on a log event will select the entire row.

Below the Log Viewer are two additional data fields that provide further detail regarding the selected event. In the Security Log, these fields are labeled Description and Data.

Icons

The first things that you will probably notice when you open a Security Log are the icons that run along the left side of the first column. These are graphical representations of the kind of attack logged on each line, and they provide an easy way to scan the Security Log for possible system errors.

Icon | Meaning
 | severe attack
 | major attack
 | minor attack

Event Log

The event log is a data sheet, where each row represents a logged event, and the columns display information regarding the event. The columns are:

  • Time - The exact date and time that the event was logged.

  • Security Type - Type of hacking attempt, such as Port Scan, Denial of Service, Trojan horse, etc.

  • Severity - One of three levels - Critical, Major, and Minor.

  • Count - Number of attacks logged.

  • Direction - Incoming or Outgoing - most attacks are Incoming, that is, they are originating from another computer and are attempting to enter yours. Other attacks, however, like Trojan horses, are programs that you might download onto your computer that then attack from within your computer, and are considered Outgoing.

  • Protocol - The type of protocol used in the attempted attack - TCP, UDP, ICMP.

  • Application Involved - This column provides the name and path of the application involved in the log event.

  • Remote IP - The IP address of the attempted attack source.

  • Remote Host Name - Name of the remote computer.

  • Local IP - Your IP address.

  • Begin Time - The time that the attack attempt began.

  • End Time - The time that the attack attempt ended.

Description and Data Fields

Below the rows of logged events are the Description and Data fields. When you click on an event row, the entire row is highlighted. A description of the event, such as "Somebody is scanning your computer, with 13 attempts", appears in the Description field.

Back Tracing Hack Attempts

  1. From the Traffic Log file, click on the event you want to back trace so that the entire row is highlighted.

  2. Either right-click the row and select Back Trace from the pop-up window, or click the Action menu and select Back Trace.

  3. Sygate® Personal Firewall™ 4.0 will back trace the event information. The Back Trace Information window will open, displaying a trace route log.

  4. To view detailed information on the original IP address, click the Whois>> button at the bottom of the Back Trace Information window. A drop panel appears, displaying detailed information about the owner of the IP Address from which the security event originated.

  5. Click the Whois<< button again to hide the information.

Filtering the Log Events by Severity

  1. In the Security Log, you can filter the events that you are viewing by the severity level of the attack.

  2. In the Log Viewer, open the View menu.

  3. Select Filter.

  4. The Filter window opens. Place check marks in each box next to the severity level(s) that you wish to view. There are three choices: Critical, Major, and Minor. You can view more than one type of event at one.

  5. The Log Viewer will automatically reload.

Viewing the Log Events by Date

  1. To filter the log event by date, click the View menu in the Log Viewer window.

  2. Select which events you would like to view from the list:

  • 1 Day Logs - Displays the events recorded on the current day.

  • 3 Day Logs - Displays the events recorded over the last three days, including the current day.

  • 1 Week Logs - Displays the events recorded over the past 7 days.

  • 1 Month Logs - Displays the events recorded over the last 30 days.

  • Show All Logs - Displays all Security Log events.

  3. The log will automatically refresh to display the requested events.


System Log

Opening the System Log

Reading the Log Information

Viewing the System Log Events by Date

What is the System Log?

The System Log records all operational changes, such as the starting and stopping of services, detection of network applications, software configuration modifications, and software execution errors. The System Log is especially useful for troubleshooting Sygate® Personal Firewall™ 4.0.

Opening the System Log

  1. There are two ways to open the log file from the SPF 4.0 main console. Choose the one that is most useful for your use.

  • Click the down arrow next to the Logs Icon. Select System Log... from the list of logs.

  • Open the Tools menu. Select Logs>System Log....

  2. The Log Viewer will open in a separate window. Every time an operational change, execution error, or system anomaly occurs, the event is recorded in the System Log. The Log Viewer provides a standard list of these logged events. Each event occupies one line on the system log.

Reading the System Log

Each log opens in the Log Viewer, with logged events arranged on a data sheet for easy identification of log details. Each row on the sheet represents one log event, and the columns provide further information regarding the event. The first column provides the date and time of the event, as well as an icon that offers a graphical representation of the kind of event logged. Clicking on a log event will select the entire row.

Below the Log Viewer are two additional data fields that provide further detail regarding the selected event. In the System Log, these fields are labeled Description and Data.

Icons

The first things that you will probably notice when you open a System Log (besides the volume of log events) are the icons that run along the left side of the first column. These are graphical representations of the kind of event logged on each line, and they provide an easy way to scan the System Log for possible system errors.

Icon | Meaning
 | error with Sygate® Personal Firewall™ 4.0 service
 | warning; potential problem with Sygate® Personal Firewall™ 4.0 service
 | information regarding Sygate® Personal Firewall™ 4.0service

Event Log

The Event Log is a data sheet, where each row represents a logged event, and the columns display information regarding the event. The columns are:

  • Time - The date and time that the event was logged.

  • Type - The type of event - this will be either Error, Warning, or Information. An Error log indicates a problem with the source, a Warning log indicates a potential problem, and an Information log merely provides information on an event involving Sygate® Personal Firewall™ 4.0.

  • ID - The ID assigned to the event by Sygate® Personal Firewall™ 4.0.

Description and Data Fields

Below the rows of logged events are the Description and Data fields. When you click on an event row, the entire row is highlighted. A description of the event, such as "Install WsProcessSensor successful....", appears in the Description field.

Viewing the Log Events by Date

  1. To filter the log event by date, click the View menu in the Log Viewer window.

  2. Select which events you would like to view from the list:

  • 1 Day Logs - Displays the events recorded on the current day.

  • 3 Day Logs - Displays the events recorded over the last three days, including the current day.

  • 1 Week Logs - Displays the events recorded over the past 7 days.

  • 1 Month Logs - Displays the events recorded over the last 30 days.

  • Show All Logs - Displays all System Log events.

  3. The log will automatically refresh to display the requested events.


Traffic Log

Opening the System Log

Reading the Log Information

Back tracing the Log Information

Viewing the Traffic Log Events by Date

What is the Traffic Log?

The Traffic Log records every packet of information that enters or leaves a port on your computer.

Opening the Traffic Log

  1. There are two ways to open the log file from the Sygate® Personal Firewall™ 4.0 main console. Choose the one that is most useful for your use.

  • Click the downward-pointing arrow next to the Logs Icon. Select Traffic Log from the List.

  • Open the Tools menu. Select Logs>Traffic Log....

  2. The Log Viewer will open in a separate window. The Log Viewer provides a standard list of logged traffic events. Each event occupies one line on the system log.

Reading the Traffic Log

Each log opens in the Log Viewer, with logged events arranged on a data sheet for easy identification of log details. Each row on the sheet represents one log event, and the columns provide further information regarding the event. The first column provides the date and time of the event, as well as an icon that offers a graphical representation of the kind of event logged. Clicking on a log event will select the entire row.

Below the Log Viewer are two additional data fields that provide further detail regarding the selected event. In the Traffic Log, these fields are labeled Description and Data.

Icons

The first things that you will probably notice when you open a Traffic Log are the icons that run along the left side of the first column. These are graphical representations of the kind of traffic logged on each line, and they provide an easy way to scan the Traffic Log. The two kinds traffic that are logged in the Traffic Log are incoming and outgoing.

  • Icon

    Meaning

    incoming traffic; passed through firewall

    incoming traffic; blocked by firewall

    outgoing traffic; passed through firewall

    outgoing traffic; blocked by firewall

    traffic direction unknown; passed through firewall

    traffic direction unknown; blocked by firewall

Event Log

The Event Log is a data sheet, where each row represents a logged event, and the columns display information regarding the event. The columns are:

  • Time - The exact date and time that the event was logged.

  • Protocol - Type of protocol - UPD, TCP, ICMP.

  • Direction - Which was the traffic moving: into your computer (Incoming) or out of your computer (Outgoing)?

  • Action - Action taken by Sygate® Personal Firewall™ 4.0: Blocked or Allowed.

  • Count - Number of events that occurred in this time period.

  • Application Involved - This column provides the name and path of the application involved in the security attack.

  • Remote Host IP - The IP address of the attempted attack.

  • Remote Host Name - Name of the host computer.

  • Remote Port - Virtual port used by application.

  • Local IP - Your IP address.

  • Local Port - Port used on your computer for this traffic.

  • Begin Time - The beginning time of the event.

  • End Time - The time the event ended.

  • Rule Name - The rule that determined the passing or blockage of this traffic. If you were blocking certain applications, this column might read “Block_All”. If Sygate® Personal Firewall™ 4.0 is running at the Normal security level, this might read “Ask all running apps”.

Description and Data Fields

Below the rows of logged events are the Description and Data fields. When you click on an event row, the entire row is highlighted. A description of the event appears in the Description field.

Back Tracing Traffic Events

  1. From the Traffic Log file, click on the event you want to back trace so that the entire row is highlighted.

  2. Either right-click the row and select Back Trace from the pop-up window, or click the Action menu and select Back Trace.

  3. Sygate® Personal Firewall™ 4.0 will back trace the event information. The Back Trace Information window will open, displaying a trace route log.

  4. To view detailed information on the original IP address, click the Detail button at the bottom of the Back Trace Information window. A drop panel appears, displaying detailed information about the owner of the IP Address from which the traffic event originated.

  5. Click the Detail button again to hide the information.

Viewing the Log Events by Date

    1. To filter the log event by date, click the View menu in the Log Viewer window.

    2. Select which events you would like to view from the list:

    • 1 Day Logs - Displays the events recorded on the current day.

    • 3 Day Logs - Displays the events recorded over the last three days, including the current day.

    • 1 Week Logs - Displays the events recorded over the past 7 days.

    • 1 Month Logs - Displays the events recorded over the last 30 days.

    • Show All Logs - Displays all Traffic Log events.

    3. The log will automatically refresh to display the requested events.


Packet Log

Enabling the Packet Log

Opening the Packet Log

Reading the Log Information

Back Tracing the Packet Log

Viewing the Packet Log Events by Date

What is the Packet Log?

The Packet Log captures every packet of data that enters or leaves a port on your computer. The Packet Log is disabled by default in Sygate® Personal Firewall™ 4.0 because of its size.

To enable the Packet Log, open the Options window by selecting Options... from the Tools menu. Click on the Log File tab and click the check box next to the text Enable Packet Log. Then click Apply.

Opening the Packet Log

  1. There are two ways to open the log file from the Sygate® Personal Firewall™ 4.0 main console. Choose the one that is most useful for your use.

  • Click the downward-pointing arrow next to the Logs Icon. Select Packet Log from the List.

  • Open the Tools menu. Select Logs>Packet Log....

  2. The Log Viewer will open in a separate window. All packets are recorded in the Log Viewer, and displayed in a standard list of logged events. Each event occupies one line on the log.

Reading the Packet Log

Each log opens in the Log Viewer, with logged events arranged on a data sheet for easy identification of log details. Each row on the sheet represents one log event, and the columns provide further information regarding the event. The first column provides the date and time of the event, as well as an icon that offers a graphical representation of the kind of event logged. Clicking on a log event will select the entire row.

Icons

There is only one icon displayed in the Packet Log. It indicates the capturing of raw data packets.

Icon | Meaning
 | full data packet captured

Event Log

The Event Log is a data sheet, where each row represents a logged event, and the columns display information regarding the event. The columns are:

  • Time - The exact date and time that the event was logged.

  • Remote IP - The IP address of the sender or recipient of the data being logged.

  • Remote Host Name - The name of the host computer.

  • Remote Port - The virtual port being used for this data.

  • Local IP - Your IP address.

  • Local Port - The port being accessed for this data.

Raw Packet Decode and Raw Packet Dump

Below the Log Viewer are two additional data fields that provide further detail regarding the selected event. In the Packet Log, these fields are labeled Raw Packet Decode, which provides data on the type of packet logged, and Raw Packet Dump, which records the actual data packet.

Back Tracing Packet Log Events

  1. From the Packet Log file, click on the event you want to back trace so that the entire row is highlighted.

  2. Either right-click the row and select Back Trace from the pop-up window, or click the Action menu and select Back Trace.

  3. Sygate® Personal Firewall™ 4.0 will back trace the event information. The Back Trace Information window will open, displaying a trace route log.

  4. To view detailed information on the original IP address, click the Detail button at the bottom of the Back Trace Information window. A drop panel appears, displaying detailed information about the owner of the IP Address from which the raw traffic event originated.

  5. Click the Detail button again to hide the information.

Viewing the Log Events by Date

  1. To filter the log event by date, click the View menu in the Log Viewer window.

  2. Select which events you would like to view from the list:

  • 1 Day Logs - Displays the events recorded on the current day.

  • 3 Day Logs - Displays the events recorded over the last three days, including the current day.

  • 1 Week Logs - Displays the events recorded over the past 7 days.

  • 1 Month Logs - Displays the events recorded over the last 30 days.

  • Show All Logs - Displays all Raw Traffic Log events.

  3. The log will automatically refresh to display the requested events.


Options Window

To Access the Options Window

The Options Window

The Options window contains some of the most important configuration tools in Sygate® Personal Firewall™ 4.0. From the Options window, you can configure Network Neighborhood browsing rights, set up email notification for attacks against your computer, set screensaver mode, and configure log files.

Opening Options...

To access the Options window, open the Tools menu, and select Options....

The Options Window

The Options window is made up for the General, Network Neighborhood, E-Mail Notification, and Log tabs.


General Tab

Automatic Launching of Sygate Personal Firewall 4.0

Receive Automatic Updates

Screensaver Mode

System Tray Icon

Password Protection

The General tab provides options for the basic running of Sygate® Personal Firewall™ 4.0.

Four buttons run along the bottom of the Options window, and can be accessed from each tab.

  • The OK button applies any changes that you have made in the Options window, and then closes the window.

  • Clicking the Cancel button ignores any changes you may have made in the Options window, and closes the window while retaining the previous settings.

Sygate Personal Firewall Service

Check this box to automatically launch Sygate® Personal Firewall™ 4.0 at start-up.

Updates

Notifies you of updates to Sygate® Personal Firewall™ 4.0. If you do not wish to be notified, clear this box of check marks.

Screensaver Mode

Enabling the Screensaver Mode option automatically sets your security level to Block All when your computer’s screensaver is activated. As soon as the computer is used again, the security level will return to the previously assigned level.

System Tray Icon

Checking this box will hide the Sygate® Personal Firewall™ System Tray Icon from view.

Password Protection

Enabling Password Protection will protect your settings from being changed by another user. Password Protection will prompt you to enter your password every time you access the Sygate® Personal Firewall™ main console.

Setting a Password

Changing a Password

To Set a Password

  1. To set a password for the first time, click the Set Password... button. The Password window opens.

  2. Leave the Old Password field blank.

  3. Enter a password in the New Password field, and type it again in the Confirm New Password field.

  4. Click OK.

To Change an Old Password

  1. To change your password, click the Set Password... button. The Password window opens.

  2. Enter your old password in the Old Password field.

  3. Enter a new password in the New Password field, and retype it in the Confirm New Password field.

  4. Click OK.


Network Neighborhood Tab

The Network Neighborhood tab provides multiple interface support and network browsing rights configuration. The Network Neighborhood tab is made up of three sections: Network Interface, Network Neighborhood Settings, and Description.

The settings in the Network Neighborhood section apply to the network displayed in the Network Interface pull-down box.

Network Neighborhood Settings

  1. Select the network from the Network Interface pull-down list.

  2. Decide if you wish to browse other computers on the network and if you wish to allow other users on the selected network to browse your computer. Under the Network Neighborhood Settings section, select the appropriate check boxes:

  • Select the Allow to browse Network Neighborhood files and printer(s) option to browse other files and printers on the selected network.

  • Select the Allow others to share my files and printer(s) to allow other users of the selected network to browse your files and printer(s).

  3. Click OK.


E-Mail Notification Tab

The E-Mail Notification tab provides you with the option to automatically notify a specified recipient via email of any attacks against your computer.

To Activate E-Mail Notification

  1. First, select the frequency of notification. You have three choices. Selecting Do Not Notify will disable the email notification option. Select Notify Immediately to have an email sent immediately following an attack on your computer. Alternately, you can select to have an email sent at regular intervals following an attack, by selecting the After Every X Minute(s) dial.

  2. Enter an email address in the From: address field. This can be your personal email address or another email address.

  3. Enter a recipient email address in the To: field. This can be an administrator's email address, or your email address, if you are accessing email remotely.

  4. If you wish, you may send a courtesy copy of each email to a specified email address in the Cc: field.

  5. Enter a subject in the Subject field.

  6. Enter your SMTP Server Address.

  7. If your email server requires authentication, click to check the box next to the indicative text. Enter the address of the authentication server in the Authentication Server Address field.

  8. Enter your username and password for the authentication server in the appropriate fields.

  9. Click OK to save changes.


Log Tab

The Log File tab provides a central location to manage the logs for Sygate® Personal Firewall ™ 4.0. You can determine the standard log size for each log, as well as specify how many days worth of entries are recorded in each log.

To Set Log Size

  1. Click on the appropriate Maximum Log File Size field and enter a size, in kilobytes, of the maximum size for the log file.

  2. Click OK.

To Set Log Days

  1. Click on the appropriate Save Log File for the Past field for the log you wish to configure.

  2. Enter a number of days.

  3. Click OK.

To Clear Log

To clear a log from the Log File tab, simply click the Clear Logs button for the log you wish to clear.

To Enable Raw Traffic Log

  1. Click to check the box next to the Sygate® Personal Firewall ™ 4.0 option.

  2. Select a maximum file size (1024 KB is the default setting).

  3. Enter a number of days for which Sygate® Personal Firewall ™ 4.0 should save the log file entries.

  4. Click OK.


Sygate Online Services (SOS)

SOS Vulnerability Assessment

Assessing your vulnerability to attack and testing your firewall are some of the most important things you can do to ensure that you are protected from possible intruders.

Click the Test button located on the main console of Sygate® Personal Firewall™ 4.0, or select Test Your System Security from the Tools menu.

The Sygate® Technologies web page (http://scan.sygatech.com) will load, and the Sygate® Online Services scanner will scan your computer and attempt to determine your IP address, operating system, and web browser.

Six Different Scans

There are six different scans available through Sygate® Online Services, listed along the left side of the main scan page. To view a brief description of the scan, click the name once. The description will load on the right side of the screen.

To Scan

To utilize a scan, click on the name of the scan and then click the Scan Now button.

A brief document of frequently asked questions about Sygate® Online Services can also be accessed from the main scan page, by clicking link labeled Scan FAQ at the bottom, left hand side of the screen.

Quick scan

Quickscan is a brief, general scan that encompasses several scan processes. The Quickscan feature usually takes 20 seconds or less to accurately scan your computer’s ports, protocols, services, and possible Trojans. Quickscan will be recorded in Sygate® Personal Firewall™ ’s Security Log.

Stealth scan

Stealth scan scans your computer using specialized stealthing techniques, which mimic portions of legitimate computer communication in order to detect the presence of a computer. The Stealth scan takes about 20 seconds to complete, and will most likely not be recorded in the Security log.

Trojan scan

The Trojan scan feature scans all of your computer’s 65,535 ports for active Trojan horse programs that you or someone else may have inadvertently downloaded onto your computer. The Trojan scan takes about 10 minutes to complete. A list of common Trojans is available on the Web site.

TCP scan

The TCP scan examines the 1,024 ports that are mainly reserved for TCP services, such as instant messaging services, to see if these ports are open to communication. Open ports indicate a dangerous security hole that can be exploited by malicious hackers.

SOS TCP scan will scan devices such as routers and proxies for users connecting to the Web site through such a device. The scan takes roughly 20 minutes to complete and is logged by Sygate® Personal Firewall™ as a scan event in the Security log.

UDP scan

The UDP scan uses various methods and protocols to probe for open ports utilizing UDP. SOS UDP scan will scan devices such as routers and proxies for users connecting to the Web site through such a device. The scan takes about 10 minutes and should be logged in the Security log as a portscan from Sygate®.

ICMP scan

When an SOS scan has completed scanning a user’s computer, it will display a page with the results of the scan. If a user is running Sygate® Personal Firewall™, all scans should be blocked.


How to Uninstall SPF 4.0

There might eventually come a time that, for some reason you may need to uninstall Sygate® Personal Firewall 4.0. This is a very simple process.

  1. Click the Start Menu on your task bar.

  2. Select Programs>Sygate Personal Firewall>Uninstall Sygate Personal Firewall.

  3. The InstallShield Wizard will guide you through the uninstall process.