Microsoft Windows XP Home Edition - Zenk - Security - Repository

Microsoft Windows XP Home Edition
Security Implementation
Version 1.4b Option 1
The next tab located in the Advanced Settings window is Security Logging.
On this window you select the logging options for the firewall. There are only two
options (Log Dropped Packets, Log Successful Connections). The Log
Dropped Packets option will log all the packets that were dropped by the
firewall. You want to log this so that you can determine whether the access was
an attempted attack or legitimate connections that were denied. The Log
Successful Connections will log all the packets that were able to connect to
you computer. If you log these type of connections you will get a file that is quite
large. It is not recommended that you enable this option for a long period of time.
The default location for the file is %SystemRoot%. It is called pfirewall.log.
This file can be difficult to read so you will probably want to import the file in
Key
Excel.
fingerprint
The file
=
is
AF19
constantly
FA27 2F94
being
998D
written
FDB5
to,
DE3D
so you
F8B5
will
06E4
need
A169
to open
4E46
the file in
Read Only mode.
The last tab in this window is ICMP Options. ICMP is Internet Control Message
Protocol. This protocol is used to communicate on the Internet. ICMP carries no
data and can be used for scanning networks, redirecting traffic, and DoS (Denial
of Service) attacks. ICF by default blocks most types of incoming and outgoing
ICMP messages. You have the ability to change the options for ICMP
messages. Below are the options and a brief description.
Allow Incoming Echo Request
This means that your computer will respond to a ping (echo) request. This
option is used typically for troubleshooting and could be turned on.
Allow Incoming Timestamp Request
This option will allow your computer to acknowledge certain requests with
a confirmation message that indicates the time the request was received.
Allow Incoming Mask Request
This option will allow your computer to listen for and respond to request for
information about the network it is attached to.
Allow Incoming Router Request
© SANS Institute 2003, Author retains full rights
This option will allow your computer to respond to requests for information
about it's routing tables.
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46
Page 20 of 53
© SANS Institute 2003, As part of the Information Security Reading Room. Author retains full rights.