StoneBlog.stonesoft.com

Connection and Blacklist monitoring have been refactored in StoneGate 5.2. At the same time when making these functions more reliable, improved the communication protocol between the SMC and engines and increased the connection table update interval, we have introduced a couple of nice features for these two views. Read more information below about how Connection and Blacklist Monitoring have been improved.

Snapshots

Once you press Pause button in Connection or Blacklist monitoring views, the system automatically creates a snapshot. You can save that snapshot for later use and find it later on from Configuration – Monitoring view. Now when there is this snapshot concept in place, it is also possible to compare different snapshots with each other. You can for example compare the “live mode” against the snapshot you just created and this way find all the new connections in the table.

Statistics

It is now possible to create statistics based on Connection monitoring data. You can for example view Top Peers diagram from the live mode of Connection Monitoring table and see as a map where the connections are established.

Data Aggregation

There is a nice new troubleshooting tool in Connection and Blacklist monitoring table. You can namely aggregate the data in the table based on any column(s). The system then counts how many entries in the table match each unique column combination used for aggregation. The aggregation actions can be found from the column headers’ right-click menu.

written by Tero Jantunen - 1,124 views \\ tags: 5.2, Aggregation, Blacklist Monitoring, Connection Monitoring, Feature Previews, firewall, IPS, Monitoring, SMC, Snapshots, statistics