1. Active Ports 1.4 ZoneLog

2. Active Ports Overview What it does Where to get it Why use it
How to use it
Screen Shots
Observations
Lessons Learned

3. What Active Ports Does Monitor TCP/UDP activity
Maps processes to specific ports
Easy to kill processes

4. Where to get it http://www.ntutility.com/freeware.html

5. Why use it Live analysis Monitor what systems access the Internet
Detect Trojans and other malware

6. How To Use It
Setup and Go

12. Observations Simple and easy to use Not very robust
Little documentation
Doesn’t always find the remote IP

13. Lessons Learned Simple tool for live analysis
Must know what should be open

14. ZoneLog

15. ZoneLog Overview What it does Where to get it Why use it How to use it
Screen Shots
Observations
Lessons Learned

16. Where to get it

17. Why use it Zone Alarm does not have a good log viewer
Get a lot more info than Zone Alarm offers

18. What it does Incident Response Helps interpret Zone Alarm log file
Gives information on data being blocked

19. How to use it Download VB6 runtime files Download application
Find ZAlog.txt
C:\WINDOWS\Internet Logs

37. Observations Not all data about attack is true
Not all features are useful
Activity graph
Good documentation

38. Lessons Learned Lots of harmless traffic
Big improvement over ZA log viewer