Documentation for Kerio WinRoute

Hosts and Users

In Status / Hosts / Users, the hosts within the local network or active users using WinRoute for communication with the Internet will be displayed.

Note: For more details about the firewall user's logon see chapter Firewall User Authentication.

Look at the upper window to view information on individual hosts, connected users, data size/speed, etc.

Host name

DNS name of a host. In case that no corresponding DNS record is found, IP address is displayed instead.

User

Name of the user which is connected from a particular host. If no user is connected, the item is empty.

Currently Rx, Currently Tx

Monitors current traffic speed (kilobytes per second) in both directions (from and to the host Rx values represent incoming data, Tx values represent outgoing data)

The following columns are hidden by default. To view these columns select the Modify columns option in the context menu (see below).

IP Address

IP address of the host from which the user is connecting from

Login time

Date and time of the recent user login to the firewall

Login duration

Monitors length of the connection. This information is derived from the current time status and the time when the user logged on

Inactivity time

Duration of the time with zero data traffic. You can set the firewall to logout users automatically after the inactivity exceeds allowed inactivity time (for more details see chapter Web Interface Parameters Configuration)

Start time

Date and time when the host was first acknowledged by WinRoute. This information is kept in the operating system until the WinRoute Firewall Engine disconnected.

Total received, Total transmitted

Total size of the data (in kilobytes) received and transmitted since the Start time

Connections

Total number of connections to and from the host. Details can be displayed in the context menu (see below)

Authentication method

Authentication method used for the recent user connection:

• plaintext user is connected through an insecure login site plaintext

• SSL user is connected through a login site protected by SSL security system SSL

• proxy a WinRoute proxy server is used for authentication and for connection to Websites

• NTLM user was authenticated with NTLM in NT domain (this is the standard type of login if Microsoft Internet Explorer 5.5 or later or Mozilla 1.4 or later is used)

• VPN client user has connected to the local network using the Kerio VPN Client (for details, see chapter Kerio VPN).

  Note: Connections are not displayed and the volume of transmitted data is not monitored for VPN clients.

For more details about connecting and user authentication see chapter Firewall User Authentication.

Information displayed in the Hosts / Users window can be refreshed by clicking on the Refreshbutton.

Use the Show / Hide details to open the bottom window providing detailed information on a user, host and open connections.

Hosts / Users Dialog Options

Clicking the right mouse button in the Hosts / Users window (or on the record selected) will display a context menu that provides the following options:

Use this option to switch to the User statistics tab in Status / Statistics where detailed user statistics can be viewed.

This option is available only for hosts from which a user is connected at the moment.

Refresh

This option refreshes information in the Hosts / Users window immediately (this function is equal to the Refresh button displayed at the bottom of the window).

Auto refresh

Settings for automatic refreshing of the information in the Hosts / Users window. Information can be refreshed in the interval from 5 seconds up to 1 minute or the auto refresh function can be switched off (No refresh).

Logout user

Immediate logout of a selected user.

Logout all users

Immediate logout of all firewall users.

Manage Columns

By choosing this option you can select columns to be displayed in the Hosts / Users window (see chapter Views Setup).

Detailed information on a selected host and user

Detailed information on a selected host and connected user are provided in the bottom window of the Hosts / Users section.

Open the General tab to view information on user's login, size/speed of transmitted data and information on activities of a particular user.

Information on logged-in users:

• User name of a user, DNS name (if available) and IP address of the host from which the user is connected

• Login time date and time when a user logged-in, authentication method that was used and inactivity time (idle).

If no user is connected from a particular host, detailed information on the host are provided instead of login information.

• Host DNS name (if available) and IP address of the host

• Idle time time for which no network activity performed by the host has been detected

Traffic information

Information on size of data received (Download) and sent (Upload) by the particular user (or host) and on current speed of traffic in both directions.

Overview of detected activities of the particular user (host) are given in the main section of this window:

Activity Time

Time (in minutes and seconds) when the activity was detected.

Activity Event

Type of detected activity (network communication). WinRoute distinguishes between the following activities: SMTP, POP3, WWW (HTTP traffic), FTP, Streams (real-time transmission of audio and video streams) and P2P (use of Peer-to-Peer networks).

Note: WinRoute is not able to recognize which type of P2P network is used. According to results of certain testing it can only "guess" that it is possible that the client is connected to such network. For details refer to chapter P2P Eliminator.

Activity Description

Detailed information on a particular activity:

• WWW title of a Web page to which the user is connected (if no title is available, URL will be displayed instead). Page title is a hypertext link click on this link to open a corresponding page in the browser which is set as default in the operating system.

• SMTP, POP3 DNS name or IP address of the server, size of downloaded/uploaded data.

• FTP DNS name or IP address of the server, size of downloaded/saved data, information on currently downloaded/saved file (name of the file including the path, size of data downloaded/uploaded from/to this file).

• Multimedia (real time transmission of video and audio data) DNS name or IP address of the server, type of used protocol (MMS, RTSP, RealAudio, etc.) and volume of downloaded data.

• P2P information that the client is probably using Peer-To-Peer network.

Connections

The Connections tab provides detailed information on connections from and to a selected host.

Information about connections:

Traffic rule

Name of the WinRoute traffic rule (see chapter Traffic Policy) by which the connection was allowed.

Service

Name of the service. For non-standard services, port numbers and protocols are displayed.

Source, Destination

Source and destination IP address (or name of the host in case that the Show DNS names option is enabled see below).

The following columns are hidden by default. They can be shown through the Modify columns dialog opened from the context menu (for details, see chapter Views Setup).

Source port, Destination port

Source and destination port (only for TCP and UDP protocols).

Protocol

Protocol used for the transmission (TCP, UDP, etc.).

Timeout

Time left before the connection will be removed from the table of WinRoute's connections.

Each new packet within this connection sets timeout to the initial value. If no data is transmitted via a particular connection, WinRoute removes the connection from the table upon the timeout expiration the connection is closed and no other data can be transmitted through it.

Rx, Tx

Volume of incoming (Rx) and outgoing (Tx) data transmitted through a particular connection (in KB).

Info

Additional information (such as a method and URL in case of HTTP protocol).

Use the Show DNS names option to enable/disable showing of DNS names instead of IP addresses in the Source and Destination columns. If a DNS name for an IP address cannot be resolved, the IP address is displayed.

You can click on the Colors button to open a dialog where colors used in this table can be set.

Note: Upon right-clicking on a connection, the context menu extended by the Kill connection option is displayed. This option can be used to kill the connection immediately.