LevelBlue Knowledge Base » Knowledgebase » Legacy Products » Threat Analysis Reporter

Does the Google Chrome browser work with 8e6 Technologies products?

Alfred Alva — Tue, 24 Jan 2012 09:47:20 GMT

This article applies to:

Enterprise Reporter
WF/WFR
Threat Analysis Reporter

Question:

Does the Google Chrome browser work with 8e6 Technologies products?

Reply

8e6 has performed a thorough test of Google Chrome for it’s compatibility with the 8e6 product line. The findings of these tests are as follows:

End-user web surfing activity is completely supported with no errors detected:

Authenticator – Pass

AD Agent – Pass

e-Directory Agent - Pass

Tier 2 Authentication - Pass

Tier 3 Authentication – Pass (May require a reinstallation of Java)

Override Account - Pass

Pattern test - Pass

HTTPS traffic (all configurations) - Pass

X-strikes - Pass

Real Time Probes - Pass

Google Safe Search - Pass

Yahoo Safe Search - Pass

AOL Safe Search - Pass

ASK Safe Search - Pass

Search Engine Keyword Filtering - Pass

URL Keyword Filtering - Pass

Extended URL Keyword Filtering - Pass

Quota Filtering - Pass

Warn Filtering - Pass

Block Page – Pass

All Web Usage Activity Logged and Reported Correctly - Pass

For Administrators accessing the R3000 GUI via Google Chrome, most features are supported. There are a small number of features within the R3000 that will not work. For the time being Google Chrome is not officially supported for access to the R3000, Enterprise Reporter, and Threat Analysis Reporter management consoles. Customers should use the supported web browsers of Internet Explorer, Firefox, or Safari to access the R3000, Enterprise Reporter and Threat Analysis Reporter management consoles. Once Google Chrome is no longer considered beta by Google, 8e6 will move to support Google Chrome for use with all management interfaces.

These are the versions that are in the PDF on our website.

Google Chrome 13.0
Internet Explorer 8.0
Mozilla Firefox 6.0
Safari 5.1

This article was previously published as:

: 8e6 KB 295442

linux vulnerabilities

Charles Creegan — Wed, 27 Oct 2010 09:52:20 GMT

This article applies to:

Web Filter (R3000, WF, WFR)
Security Reporter (SR)
Enterprise Reporter (ER)
Threat Analysis Reporter (TAR)

Question:

Please confirm if following vulnerability affects the embedded linux on Trustwave WFR/SR/ER/TAR Appliances.

http://www.us-cert.gov/current/archive/2010/10/25/archive.html#linux_root_access_vulnerabilities

Information:

The Reliable Datagram Sockets (RDS) protocol is not enabled on the named appliances, so they are not vulnerable to this issue.

How to setup the TAR diagram

Patricia Otteson — Wed, 30 Jun 2010 14:58:00 GMT

TAR lockout

Patricia Otteson — Wed, 09 Jun 2010 15:35:00 GMT

This article applies to:

TAR 2.0.00.11

Question:

Where do I go to unlock users in the new TAR version 2.0.0.11?

Information:

Log into the TAR and then click Gauges->Lockouts->Select either "URL Lockouts" or "Bandwidth Lockouts". This would show you all the users that have been locked out, select or highlight the user(s) IP that you need to unlock, and then click the Unlock button at the bottom of the GUI. That should unlock the user.

Does TAR has a database to query

Patricia Otteson — Wed, 09 Jun 2010 15:00:00 GMT

This article applies to:

Threat Analysis Reporter (TAR)

Question:

Does the Threat Analysis Reporter (TAR) have a database that I can query to see users that have been locked out in the past?

Information:

The TAR does not have a formal database for keeping records rather it only sends alerts when a user(s) gets locked out and the administrator can simply archive the records.

TAR Bandwidth Gauges register zero activity

Giovanni Romualdi — Thu, 29 Apr 2010 18:50:00 GMT

This article applies to:

Threat Analysis Reporter

Question:

TAR Bandwidth Gauges register zero activity

Procedure:

The fix is for the user to turn off the Auto MDI/MDI-X feature for the ports connected to a TAP. If the user’s switch is not capable of this, the switch will need to be replaced. If the user don't have Auto MDI/MDI-X feature enable on the switch. Or after turn off the Auto MDI/MDI-X feature problem still exist. Please contact Technical Support.

Notes:

MDI (Medium Dependent Interface port)

Also called an "uplink port," it is a port on a network hub or switch used to connect to other hubs or switches without requiring a crossover cable. The MDI port does not cross the transmit and receive lines, which is done by the regular MDI-X ports that connect to end stations (the X stands for "crossed"). The MDI port connects to the MDI-X port on the other device. There are typically one or two ports on a device that can be toggled between MDI (not crossed) and MDI-X (crossed).

Automatic MDI/MDI-X
Some time ago, automatic line sensing was developed within Ethernet, which detects whether the crossover is needed or not. Referred to as "auto MDI/MDI-X," "universal cable recognition" and "auto sensing," it eliminates having separate MDI and MDI-X ports, selector switches and special crossover cables on the equipment.

Based on the above definitions, it appears all should be well, BUT if the Auto MDI/MDI-X feature is turned on, the switch can randomly reverse the cable connection (due to a cable change, switch reset, line down/line up sequence, etc.). A network tap cannot cope with this connection reversal and is rendered inoperable.

Auto MDI/MDI-X switch on network causes tap failure

Giovanni Romualdi — Thu, 29 Apr 2010 15:33:00 GMT

This article applies to:

We have RMA’d a number of taps since the introduction of the TAR product. Subsequent to their return, each of these taps was tested and none have proven to be faulty. After consulting with the tap manufacturer, a likely cause of perceived tap failure is the Auto MDI/MDI-X feature on network switches.

Symptoms:

MDI (Medium Dependent Interface port)
Also called an "uplink port," MDI is a port on a network hub or switch used to connect to other hubs or switches without requiring a crossover cable. The MDI port does not cross the transmit and receive lines as executed by the regular MDI-X ports that connect to end stations (the X stands for "crossed"). The MDI port instead connects to the MDI-X port on the other device. There are typically one or two ports on a device that can be toggled between MDI (not crossed) and MDI-X (crossed).
Automatic MDI/MDI-X
Some time ago, automatic line sensing was developed within Ethernet, detecting whether the crossover is needed or not. Referred to as "auto MDI/MDI-X," "universal cable recognition," and "auto sensing," this feature eliminates having separate MDI and MDI-X ports, selector switches, and special crossover cables on the equipment.
Based on the above definitions, it appears all should be well on the network, however, if the Auto MDI/MDI-X feature is turned on, the switch can randomly reverse the cable connection (due to a cable change, switch reset, line down/line up sequence, etc.). A network tap cannot cope with this connection reversal and thus is rendered inoperable.

Resolution:

The user should turn off the Auto MDI/MDI-X feature for the ports connected to a tap. If the user’s switch is not capable of disabling the Auto MDI/MDI-X feature, the switch will need to be replaced, not the tap.

Number of drives in a Threat Analysis Reporter

Patricia Otteson — Thu, 29 Apr 2010 15:18:00 GMT

This article applies to:

Threat Analysis Reporter (TAR 2.0.0.11)

Question:

How do I tell if my Threat Analysis reporter is a raid unit or not from the GUI?

Information:

When you log into the TAR gui you should select the Administration tab from the available options and then select the Hardware Detector, this would populate the number of drives in the unit and also identify if it’s a raid unit or not. It would also show the RAID Status and Action

How can I view DMI event log

Patricia Otteson — Thu, 29 Apr 2010 15:05:00 GMT

This article applies to:

R3000
Enterprise Reporter
Threat Analysis Reporter

Question:

How can I view DMI event log

Procedure:

To view the DMI log, please use the following procedure.

1) Reboot the system, when the Supermicro logo is displayed press the delete key to go into the BIOS setup menu.

2) Using the arrow keys, move over to the right to highlight 'advanced' menu and press enter. See attached photo 'advanced_menu' for an example of this menu.

3) Using the arrow keys, move down to the 'DMI event log item', and press enter. See attached photo 'view_log' for an example of this menu.

4) Using the arrow keys, move down to the 'View DMI event log' choice, and press enter. A pop-up window will be displayed, Look for any memory errors. These would say something like ECC error or similar.

5) To exit from the BIOS setup, press the escape key 3 times, this will take you to the exit menu. Use the arrow keys to move down and select the 'exit without saving' choice, and press enter. A popup window will appear with the confirmation question "quit without saving?". Type a Y and press enter to confirm. The system will reboot.

How can I run a factory reset on a TAR from the backend?

Patricia Otteson — Thu, 29 Apr 2010 14:58:00 GMT

This article applies to:

Question:

How can I run a factory reset on a TAR from the backend?

Procedure:

In order to perform a factory reset on a TAR, log into MySQL on the box, and then run the following command:

source /backup/bkfactory.sql

This will empty out all of the MySQL tables with saved settings.

Notes:

This command is the same as what runs when a factory reset is initiated from the TAR GUI. As such, it will not wipe out any patches, so it is unlike the R3000 factory reset in that regard.

Hard drive indicator shows red light, however Hardware Detector panel shows all drives OK.

Patricia Otteson — Thu, 29 Apr 2010 14:33:00 GMT

This article applies to:

R3000
Enterprise Reporter
Threat Analysis Reporter
H, HL and SL models only

Question:

Hard drive indicator shows red light, however Hardware Detector panel shows all drives OK.

Information:

In a Supermicro SAS drive environment, the red LED light would indicate a failed hard drive. However, in Trustwave’s SATA drive environment, this is not the case (Supermicro SATA architecture does not provide for a drive failure light functionality).

As a result, end-users have erroneously replaced hard drive(s) only to find the red hard drive indicator still might be on.

Solutions:

The only true indicators of a hard drive failure on H, HL and SL models are through the Hardware Failure Detection / Hardware Detector panel of the user interface and the related alert emails triggered when the Trustwave application detects a drive failure.
Drives should only be replaced when the aforementioned user interface and/or alert email indicate(s) that such action is appropriate and then only for the drive(s) stipulated.
IMPORTANT: Because most users will not regularly check the user interface for drive failures, it is critical that alert email addressees be set up for immediate notification of hardware exceptions.

If you have any questions regarding the above information or you have a fail drive, please contact Trustwave Technical Support.

Buffer I/O error on device fd0, logical block 0

Thomas Pfau — Tue, 04 Aug 2009 16:05:00 GMT

This article applies to:

R3000 2.2
ER 5.1
TAR
ProxyBlocker

Symptoms:

These error messages appear on the console during boot-up.

kernel: Buffer I/O error on device fd0, logical block 0

kernel: end_request: I/O error, dev fd0, sector 0

Causes:

These errors are related to not having a floppy drive on the appliance. The operating system is attempting to read from a floppy disk device which isn't part of the appliance. These errors will be resolved in the next kernel update
There are no negative side effects to these messages other than the few seconds that the system spends trying to access the floppy drive during boot.

Resolution:

The errors will go away in the next kernal upgrade.

How to check DMI event log

Giovanni Romualdi — Tue, 30 Jun 2009 23:58:00 GMT

This article applies to:

R3000 / ER / TAR SL or HL models

Question:

How do I check the DMI event log for any errors?

Procedure:

To view the DMI log, please use the following procedure.

1) Reboot the system, when the Supermicro logo is displayed press the delete key to go into the BIOS setup menu.

2) Using the arrow keys, move over to the right to highlight 'advanced' menu and press enter. See attached photo 'advanced_menu' for an example of this menu.

3) Using the arrow keys, move down to the 'DMI event log item', and press enter. See attached photo 'view_log' for an example of this menu.

4) Using the arrow keys, move down to the 'View DMI event log' choice, and press enter. A pop-up window will be displayed, if you are interested in any memory errors these would say something like ECC error or similar.

5) To exit from the BIOS setup, press the escape key 3 times, this will take you to the exit menu. Use the arrow keys to move down and select the 'exit without saving' choice, and press enter. A popup window will appear with the confirmation question "quit without saving?". Type a Y and press enter to confirm. The system will reboot.

Notes:

Optional.

TAR Gauges stuck at zero after an R3000 filter RMA

Thomas Pfau — Mon, 22 Jun 2009 18:39:00 GMT

This article applies to:

Theat Analysis Reporter (TAR)
R3000 Filter

Symptoms:

After an RMA of an R3000 filter (either the hard drive or the entire unit) that a TAR has been associated with, the TAR gauges are stuck at zero.

Causes:

During initial setup, the TAR will reach out to the filters associated with it and modify the backend filter configuration to make the filter send traffic info to that TAR. If the hard drive of the filter is replaced, then these configuration changes are lost and the filter no longer knows that a TAR is present on the network.

Resolution:

If you are running TAR version 1.3.10 or above, you can simply go into the TAR's device registry and re-synchronize the devices. TAR versions prior to this will be unable to do this - in these cases, you will either need to patch the TAR to 1.3.10+, or contact Technical Support to have the filter's backend configuration manually modified.

How to configure WhatsUp Gold to use SNMP v2c

Thomas Pfau — Mon, 22 Jun 2009 18:33:00 GMT

This article applies to:

R3000
ER
TAR

Question:

How do I configure WhatsUp Gold to use SNMP v2c?

Procedure:

The R3000, ER, and TAR appliances are compatible with SNMP v2c. (Version 1 is no longer supported).

You must specify "SNMPv2c" when you CREATE a new SNMP credential. You cannot go back and edit an existing credential. So, go into the Credentials Library and create a NEW SNMP credential, specifying "SNMPv2c" as the type.

Notes:

Optional.

How to view the BIOS DMI event log

Thomas Pfau — Mon, 11 May 2009 23:51:00 GMT

This article applies to:

R3000 Enterprise Filter
Enterprise Reporter
Threat Analysis Reporter

Question:

How to view the BIOS DMI event log

Reply

To view the DMI log please use the

following procedure:

1) Reboot the system, when the Supermicro logo is displayed press

the delete key to go into the BIOS setup menu.

2) Using the arrow keys, move over to the right to highlight

'advanced' menu and press enter.

3) Using the arrow keys, move down to the 'DMI event log item', and

press enter.

4) Using the arrow keys, move down to the 'View DMI event log'

choice, and press enter. A pop-up window will be displayed with the log.

5) To exit from the BIOS setup, press the escape key 3 times, this

will take you to the exit menu. Use the arrow keys to move down and

select the 'exit without saving' choice, and press enter. A popup

window will appear with the confirmation question "quit without

saving?". Type a Y and press enter to confirm. The system will reboot.

This article was previously published as:: 8e6 KB 298092

TAR Bandwidth Gauges register zero activity

Thomas Pfau — Mon, 11 May 2009 23:48:00 GMT

This article applies to:

Threat Analysis Reporter

Question:

TAR Bandwidth Gauges register zero activity

Reply

If the bandwidth gauges in your TAR are not moving, check the timespan value assigned to them and make sure it's not set to anything less than 5 minutes (default is 15 minutes).

The threshold for the timespan minimum time window is really determined by the environment the TAR is in, as higher volumes of traffic will require more processing time. In a high traffic traffic environment, it will take about 3 to 4 minutes for the TAR to process the volume of data that is going through it before the bandwidth gauges will display anything. Any gauges that are set for a threshold of less than this will end up showing no data. We will be looking to improve this behavior in future versions of TAR, but at this point, we don't have the functionality built in to allow TAR to automatically adjust this value according to load.

This article was previously published as:: 8e6 KB 299675

How Do I Perform a Factory Default Reset on the TAR?

Brian Tsu — Wed, 28 Jan 2009 00:00:00 GMT

This article applies to:

Threat Analysis Reporter

Question:

How Do I Perform a Factory Default Reset on the TAR?

Reply

How Do I Perform a Factory Default Reset on the TAR?

If you need to run a factory default reset on the TAR, you can do so from an option under the Backup/Restore section of the GUI. Performing a reset will allow you to access the initial setup wizard again, and let you make changes there (such as enabling LDAP support on the TAR). A reset will destroy any customized gauges on the TAR, but it will not uninstall any patches performed on the box. Also, note that the factory default reset option was added in the 1.1.00.11 version of the TAR software - earlier versions will not have this option.

This article was previously published as:: 8e6 KB 284207

Cannot enter special characters in TAR passwords

Brian Tsu — Tue, 16 Dec 2008 00:00:00 GMT

This article applies to:

Threat Analysis Reporter

Question:

Cannot enter special characters in TAR passwords

Reply

Currently, there is a problem with the TAR GUI that will prevent the use of special characters (such as @, $, !, etc) in password fields. This problem will be addressed in a future version release of the TAR. If this is causing major problems, however, please contact tech support - a temporary fix for this issue is available.

This article was previously published as:: 8e6 KB 299971

What ports are required to be open on the network for the TAR to communicate with the R3000 and ER?

Patricia Otteson — Mon, 27 Oct 2008 00:00:00 GMT

This article applies to:

Threat Analysis Reporter

Question:

What ports are required to be open on the network for the TAR to communicate with the R3000 and ER?

Reply

What ports are required to be open on the network for the TAR to communicate with the R3000 and ER?

The following ports must be open:

4800
6600
1443

Port 6600 must be open on the TAR for the R3000 to be able to connect to the TAR. The R3000 connects to the TAR on this port and sends logs to the TAR.

Port 4800 must be open on the R3000 for the TAR to be able to connect to the R3000. The TAR connects to the R3000 on this port to to send commands.

Port 1443 must be open on the R3000. The TAR connects to the R3000 on this port to retrieve user group information.

This article was previously published as:: 8e6 KB 297448

Where do I Reboot the tar?

Alfred Alva — Thu, 16 Oct 2008 00:00:00 GMT

This article applies to:

Threat Analysis Reporter

Question:

Where do I Reboot the tar?

Reply

Is there a place in the GUI to reboot the TAR ?(Threat Anaylisis Reporter)

No, currently you must push the power button to reboot the Tar.

This article was previously published as:: 8e6 KB 297102

What is the default username/password for the TAR GUI?

Sonetra Tol — Wed, 15 Oct 2008 00:00:00 GMT

This article applies to:

Threat Analysis Reporter

Question:

What is the default username/password for the TAR GUI?

Reply

The TAR GUI does not have a default login account. The Super-Admin account is configured during the initial setup wizard and you have to specify what the username and password for that account will be. Using that account, you can create other login accounts. But there is no default account that exists before the inital setup.

This article was previously published as:: 8e6 KB 297065

How do I create admin accounts on the TAR?

Patricia Otteson — Mon, 16 Jun 2008 00:00:00 GMT

This article applies to:

Threat Analysis Reporter

Question:

How do I create admin accounts on the TAR?

Reply

How do I create admin accounts on the TAR?

First, you will need to create a "Group" to set management permissions, so the group administrator you set will only be able to access areas of the TAR console you specify.

In the navigation panel, click Admin Groups to open the Group Management pop-up window:

Click Add a Group to open the Add a new Group pop-up window:

Type in up to 32 characters for the Group Name. TIP: You may want to name the group for the type of permissions to be assigned. This will distinguish the name from other names, such as those set up for user groups.

By default, “Gauges” is selected and therefore grayed out. This indicates the administrator to be added will be able to view and modify gauge content. Click the appropriate checkbox(es) to specify the type of access the administrator will be granted on the TAR console or its related devices:

After permission sets have been created, profiles of group administrators can be set up to monitor user groups.

In the navigation panel, click Admins to open the Admin System pop-up window:

Click Add New Admin

Type in the TAR Login ID the group administrator will use to access the TAR interface.

Type in the Password the group administrator will use in conjunction with the TAR Login ID, and enter that same password again in the Confirm Password field.

Click Next to go to the Contact Info tab.

Type in the group administrator’s Employee Name.

Type in the group administrator’s Work Phone number, without entering special characters such as parentheses ( ), a hyphen (-), a period (.), or a left slash (/).

Optional: Type in the group administrator’s Home Phone number without entering any special characters.

Type in the group administrator’s Email address.

Optional: Type in identifying information about the group administrator’s physical office Location.

Optional: Type in any Comments to be associated with the group administrator’s account.

Click Next to go to the Groups tab.

In the Group tab you select the user group(s) to be monitored by the group administrator.

In the Available list, click the user group(s) to highlight your selection(s), and to activate the Add button.

Click Add to include the user group(s) in the Assigned list box.

After selecting each user group to be assigned to the group administrator, click Submit to close the Add new Administrator pop-up window and to return to the Admin System pop-up window.

Note that the Active Users frame now includes the group administrator’s TAR Login ID.

This article was previously published as:: 8e6 KB 289383

I cannot login to the TAR's initial setup wizard GUI

Brian Tsu — Tue, 03 Jun 2008 00:00:00 GMT

This article applies to:

Threat Analysis Reporter

Question:

I cannot login to the TAR's initial setup wizard GUI

Reply

If you are attempting to login to the TAR's initial setup wizard GUI after having set IPs and such through the console, but the GUI seems to do nothing after entering in your login/password, then there may be a problem with a certain file on the backend. This file specifies what address can be used to access the TAR GUI - it should contain your TAR's IP address. As such, there are generally two possible problems here: either the file did not get written correctly, or you are trying to access the TAR via an address other than its IP (such as through a NAT or hostname).

If you are accessing the GUI through the TAR's IP, then try logging back into the console wizard (where you initially set the box IPs and such). From the main menu, select option 9 (Web Interface IP Address) and make sure that it has the TAR's IP listed here. Correct it if not. Either way, this will force the box to write to the backend file and make the GUI accessible.

This article was previously published as:: 8e6 KB 287950

Why are the Group permissions grayed out for a new Group Administrator?

Patricia Otteson — Mon, 02 Jun 2008 00:00:00 GMT

This article applies to:

Threat Analysis Reporter

Question:

Why are the Group permissions grayed out for a new Group Administrator?

Reply

Why are the Group permissions grayed out for a new Group Administrator?

The permissions below are reserved for the global administrator and cannot be assigned to group administrators.

Device Registry - edit settings for an R3000, ER, or TAR (a bandwidth IP address range for TAR can also be added or removed); add another R3000, or add an ER (if the latter was not previously added); view information about devices connected to the TAR server; or synchronize—with TAR—the source R3000’s supplied library category updates, custom categories, and devices connected to TAR.

Custom Categories - maintain the list of custom library categories to be used by gauges, and synchronize the source R3000’s custom categories with TAR.

Threat Scores - manage the severity levels for library categories.

This article was previously published as:: 8e6 KB 288670