Ports View
The Ports View is displayed on the left panel of the main window. It comprises of a tree structure that displays the name and status of the KFSensor Server and the ports on which it is listening.
The Ports View can be displayed by selecting the Ports option from the View menu.
The Port View is linked to the Events View and acts as a filter to it. For example if you select port 80, then only those events related to port 80 will be displayed in the Events View.
The tree structure comprises of the following elements and levels:
Server
The top level item is the server. The IP address of the KFSensor Server and the name of the currently active
Scenario are displayed.
The server icon indicates the state of the server:
| Icon | State | Description |
 |
Running | The KFSensor Server is running and operational |
 |
Stopped | The KFSensor Server is not running |
 |
Error | An error occurred when running the KFSensor Server |
Protocol
The protocol level is used to group the ports based on their protocol; either TCP or UDP.
Port
Each port that the KFSensor Server is listening on is listed in numerical order.
These are controlled by the Listen definitions in the currently active
Scenario.
The port number and the Listen name are displayed, together with an icon indicating the state of the port.
The actual Listen Icon
displayed will be the icon specified in the listen definition.
| Icons | Color | State | Description |
|
Green | No recent activity | No events have been detected on this port for a considerable period of time. |
|
Yellow | Recent activity | An event has been detected on this port recently. The exact time interval of a recent event can be configured using the Customize dialog box. |
|
Red | Very recent activity | An event has been detected on this port very recently. The exact time interval of a very recent event can be configured using the Customize dialog box. |
|
Grey | Inactive | This port is not active and will generate no events |
|
Blue | Error | The listen on the port failed to start. This is usually because another service is already using this port. See the Correcting Port Errors in the Admin Guide for details on how to fix these. |