[KB742] How to activate special logging of the Personal firewall

Solution

In some instances, you may need to enable a special logging mode to help troubleshoot problems with blocked connections in the Personal firewall module, such as conflicts with other NDIS filtering device drivers. This mode allows the Personal firewall to log additional information about the computer’s network connection(s) which can be used by ESET’s support specialists to help resolve issues.

The Personal firewall special logging mode should only be used if:

  • No entries are written to Tools Log files ESET Personal firewall log when the Personal firewall IDS and advanced options Log all blocked connections option is enabled in the Advanced Setup window.
  • Problems continue to occur after the Personal firewall module has been disabled.

Follow the steps below to activate special logging:

 

Important!

If you are using version 4.0 or newer of your ESET security product, you will need to restart your computer in Safe Mode. To do this, tap the F8 key repeatedly during startup until the Windows Advanced Options Menu is displayed. Select Safe Mode and press ENTER. Proceed without using Safe Mode if your ESET security product is 3.0 or earlier.

 

 

  1. Click Start → Run. The Run window will be displayed. Type regedit and click OK (Windows Vista users: Click Start, type regedit and press ENTER).
     
  2. Navigate to the following key: HKLMSOFTWAREEsetESET SecurityCurrentVersionPlugins1000200Profiles@My profile
     
  3. Create a new DWORD value titled WriteBlockedToPcap and set its value to 1. Restart your computer.
     
  4. All blocked packets will now be saved to the following directory:

    Windows XP: C:Document and SettingsAll UsersApplication DataEsetEset Smart SecurityEpfwLog.pcap

    Windows Vista: C:ProgramDataESETESET Smart SecurityEpfwLog.pcap

    Windows 7: C:ProgramDataESETESET Smart SecurityEpfwLog.pcap
     
  5. Replicate the problematic situation.
     
  6. Disable special logging (set the WriteBlockedToPcap value to 0 and restart your computer).
     
  7. Send the file EpfwLog.pcap (and all other files in the same folder beginning with ‘Epwf’) for analysis to ESET’s support specialists. The contact email address is support@eset.com. 

 

NOTE:

Please replicate the problem as soon as possible after step 3 and then disable special logging mode (step 6). This will prevent the logging of extraneous or misleading network communications. However, simulating the problem several times in a row before disabling debug mode will provide additional relevant data for analysis.