Rohde & Schwarz GP-E - FTC (Forensic Traffic Capture)

User Interface
R&S
®
GP-E/GP-S
64User Manual v16.2.1 ─ 01
Field Description
"Active Period" Set the time (in minutes) for how long remote
access will be granted. When this time elapses, the
CLI access will be disabled automatically.
"Start Time" Set the date and time when remote access to the
gateprotect Firewall will become available for the
support team.
The buttons at the bottom right of the editor panel allow you to shut ( "Close" ) the edi-
tor panel as long as no changes have been made and to store ( "Save" ) or to discard
( "Reset" ) your changes.
Click " Activate" in the toolbar at the top of the desktop to apply your configuration
changes.
3.4.2.7 FTC (Forensic Traffic Capture)
Forensic Traffic Capture (FTC) can be used to identify the precise timing, scope, and
nature of a malicious attack from outside or inside sources on your network.
Two types of files are captured for each flow:
●
PCAP files – contain the stored packets of a flow and
●
FTC files – contain metadata (for example, the protocol type, information about the
connection and, if applicable, an RSA Session ID and a Master Key to decrypt
encrypted traffic stored in the appropriate PCAP file).
To examine the downloaded PCAP files, use any packet analyzer (e.g. Wireshark).
FTC Overview
Navigate to "Network > FTC" to display the list of custom firewall rules in which Foren-
sic Traffic Capture is enabled in the item list bar.
In the expanded view, the columns of the table display the name of the custom firewall
"Rules" and the number of "FTC Files" and "PCAP Files" captured by it. The buttons in
the last two columns allow you to delete, download, and view all captured traffic for the
rule.
For further information, see Chapter 3.2, "Icons and Buttons", on page 21.
FTC Settings
Use the FTC "Settings" to view and edit the pre-defined storage policy to be used
when enabling Forensic Traffic Capture in custom firewall rules.
Under "Network > FTC > Settings" , you can view the pre-defined FTC profile.
The "Settings" panel allows you to edit the following elements:
Menu Reference