myNetWatchman Agent Installation & Configuration

1. Prepare for myNetWatchman Installation
   1. Install and configure your firewall or router according to vendor's directions.
   2. Verify system clock/time zone settings
   3. Synchronize time
   4. If your firewall logfile has entries more than 3 days old, please clear the log file before starting myNetWatchman.
      
      
2. Install the myNetwatchman Agent.
   1. From Windows Explorer, double-click on the file you downloaded.
   2. Follow the on screen prompts for selecting an installation directory.
   3. After the client is installed, it will automatically start and display the Configure window
      
      
      
      
   4. Enter your e-mail address and myNetWatchman password in the respective fields. Be careful to enter your e-mail/password exactly as you did when you registered. If they don't match, then the myNetWatchman server will NOT process your uploaded attack data.
      
      
   5. Select Firewall format and logfile location. If you are using BlackICE or ZoneAlarm, the agent will attempt to auto-detect these settings. Review them and make sure the correct settings have been detected. Check your settings carefully against the following table, as some of the selections are not intuitive.
      
      

      FIREWALL	SETTINGS & NOTES
      BlackICE	myNetWatchman will automatically set the appropriate FormatID and logfile location. Logfile: C:\Program Files\NetworkICE\BlackICE\attack-list.csv (or wherever you installed it) Log File Format: BlackICE
      Zone Alarm or Computer Associates sTrust EZ	If you are using Zone Alarm, then you'll need to manually change these settings as follows: Logfile: C:\Windows\Internet Logs\zalog.txt (or wherever you've installed it) Log File Format: Zone Alarm
      Netgear/Zyxel Cable/DSL Router	Note: Netgear/Zyxel has to be one of the most cryptic and arcane user interfaces anywhere. Click here for specific instructions for configuring their log files so that myNetWatchman can access them. Logfile: (enter EXACT path and filename of your router log file) Log File Format: Netgear via Kiwi
      SMC Barricade and/or Dlink DI-704	Router Logging Setup Procedures Logfile: (enter EXACT path and filename of your router log file) Log File Format: Dlink, SMC Barricade
      Microsoft XP Firewall	Enable logging: Open Local Area Network Connection properties, select Advanced, click Settings, select 'Security Logging' tab, enable 'Log dropped packets' Logfile: C:\Windows\pfirewall.log (default location) Log File Format: Microsoft Internet Connection Firewall
      Cisco via Kiwi Syslogd	Cisco via Kiwi Setup Procedures Logfile: C:\Program Files\syslogd\syslogcatchall.txt (default location) Log File Format: Cisco via Kiwi
      Linksys with Kiwi SNMP logger	Linksys Logging Setup Procedures Logfile: C:\Program Files\syslogd\all-debug.txt (default location) Log File Format: Linksys via Kiwi
      Linksys with WallWatcher Logger	WallWatcher Setup Procedures Logfile: C:\Program Files\WallWatcher\WWmNW.txt (suggested location) Log File Format: WallWatcher
      Sonic Wall with Kiwi Syslogd	Sonic Wall / Kiwi Setup Procedures Logfile: C:/Program Files/syslogd/syslogcatchall.txt Log File Format: Sonic Wall

      
      
      
   6. The "host" field will be configured automatically as "www.mynetwatchman.com" .

   If any of these settings seem incorrect, please contact myNetWatchman Support.

3. View the current upload status by clicking on the "Status" tab
   
   
   
   When an upload is actually taking place, the system-tray shield will turn green until the upload is complete. Currently, uploads take between 0.5 and 3/0 seconds per firewall event. If your firewall log has many entries, it may take several minutes to upload all of it.
   
   Note: The "file size" and "high watermark" items on this screen show how much data there is to upload and how much has already been uploaded. If your firewall log has been collecting data for a long time, the file size can be unduly large. We strongly recommend that you delete your old firewall log or purge it to contain only recent events.
   
   
4. Test the myNetWatchman Agent by pinging or tracerting to yourself using: MAE West Looking Glass. Once the data has been uploaded, log into the myNetWatchman website and check that this "attack" appears in your "Events Reported Today" Report (listed in the myREPORTS menu on the left side of the screen).
   
   
5. When you are satisified that the myNetWatchman is configured correctly click OK to close the status window. During normal system operation, myNetWatchman is displayed as a white "shield" icon in your system tray as shown below. Clicking on the shield and selecting Status will re-open the status window.