Jump to content

How to view pre-login traffic blocked by EIS firewall?


Recommended Posts

Posted (edited)

How can one determine exactly what EIS blocks before a user logs on to a Windows PC?

If EIS is set to Interactive mode, after a user logs on to the PC, the user will be alerted with a pop-up that tells the user that EIS is blocking specific traffic and waits for a response from the user to continue blocking or allow the traffic. This works great for traffic AFTER a login.

However, the problem that I encounter is that some pre-login traffic is being blocked but ESET does not log the blocked traffic so I don't know what Allow rule(s) need to be created to allow the traffic. I found this post which states, 'The only way I know of to log blocked network connections when the firewall is set to Interactive mode is to create an Ask rule to monitor any network inbound and outbound traffic for any protocol.'

Creating an Ask rule as described in that post only logs the remote IP address where the traffic was going to. How can we make EIS log all information about the blocked, pre-login traffic so that it logs the program that is generating the traffic that is being blocked and domain name if one was used instead of an IP? In other words, how can we view the same type of info, that is presented in the Interactive pop-ups, for pre-login traffic which is being blocked?

Edited by jeffshead
Link to comment
Share on other sites

  • Administrators

Run the firewall troubleshooting wizard to get a list of recently blocked connections with an option to unblock them with a few clicks.

Link to comment
Share on other sites

Posted (edited)

I don't see a Firewall Troubleshooting Wizard. If you are referring to Setup > Network protection > Network Protection Troubleshooting, it does not show anything (relating to to pre-login traffic) being blocked. Like I stated previously, EIS is set to Interactive so the Network Protection log is always empty which I think is ridiculous.

Edited by jeffshead
Link to comment
Share on other sites

Posted (edited)
54 minutes ago, Marcos said:

If you see zeroes here, then no communication was blocked:

With all do respect, I must say your statement is not correct. EIS is blocking the traffic but it is not being logged anywhere; including the Troubleshooting wizard. If I go to Setup > Network protection > Firewall and select 'Disabled permanently', the traffic is not blocked. Otherwise the traffic is blocked but not logged.

This behavior was reported by others who also use Interactive mode, a couple of years ago.

I managed to force EIS to log the traffic that it is blocking by utilizing the info posted in the thread I linked to in the previous paragraph. I enabled Enable Network protection advanced logging and created a general catch-all ASK firewall rule and set it to Information level logging in order to log the blocked traffic. Until I did this, the Network Protection log was completely empty. In fact, it's always empty on every PC that has EIS set to Interactive mode.

I love ESET but having to spend so much time researching how to log traffic that should be logged by default is bad.

Edited by jeffshead
Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...