This chapter assumes that you are familiar with the material presented in Basic Concepts.

General preferences

To set Who's There? preferences, choose "Preferences" from the Who's There? menu. The preferences dialog, shown below in Figure 1, can be viewed in two panes: General and Display. Choose the pane you want by clicking the corresponding icon. The General pane is used to specify two items: the log file to be processed, and the email template. Each is discussed in a separate section below.

Log files (12, Features)

Who's There? can process firewall log files in one of three formats:

• OS X ipfw log format -- Used by the Macintosh's built-in ipfw firewall technology ("ipfw"). Firewalls using ipfw and logging in this format include Open Door's DoorStop X, OS X Server and Flying Buttress.
  NOTE: Not all ipfw firewalls create a log file. The firewalls built into Mac OS X 10.2 and 10.3 are examples of ones which do not (and are thus not supported by Who's There?).
• Extended WebSTAR log format -- A tab-delimited text format used by firewalls such as NetBarrier. This format is based on that used by the WebSTAR Web server.
• NPF 3 log format -- Used by Norton Personal Firewall 3.0 and later.

Logging firewalls using OS X's built-in firewall technology ("ipfw") write to a log file, the name, location and format of which depend on the version of OS X you're using and how the firewall uses ipfw. NOTE: Mac OS X 10.5's built-in firewall does not use ipfw technology and is not supported.

To a point, the more information a log file contains, the more useful Who's There? becomes, due to patterns and trends in access attempts possibly becoming clearer. However, all log files created by ipfw are automatically rolled (archived and then cleared) by OS X (daily or weekly, depending on the version of OS X). When a log file is rolled, all access information prior to the moment of rolling becomes unavailable to Who's There, making Who's There? somewhat less useful. If you're using DoorStop X (part of the DoorStop X Security Suite), this is not a problem, because DoorStop tells OS X to write ipfw lines to the default location, AND to a separate log file that is not automatically rolled by OS X (but can be set to roll automatically within the DoorStop application). If you are not using DoorStop X, but rather another ipfw-based firewall, it may be possible to prevent Mac OS X from rolling the log file. Contact Open Door Networks directly for details.

When launched, Who's There? will look for a log file to process, in this order:

1. /Library/Preferences/DoorStopX.log - Not currently used, but may be in future versions.
2. /Library/Preferences/WhosThere.log - Created by DoorStop X.
3. /Library/Application Support/Norton Solutions Support/Norton Personal Firewall/Norton Personal Firewall Log - Created by Norton Personal Firewall 3.0 and later.
4. (Tiger only) /var/log/ipfw.log - Created by OS X 10.4's built-in firewall.

If Who's There? cannot find one of the above log files, you will be given the option of locating a log file (below).

Lines in OS X's ipfw log format do not include the year of the access attempt. When reading a line from WhosThere.log (or ipfw.log), Who's There? assumes the current year. If this results in a date ahead of the current date, Who's There? subtracts 1 from the year. This means that log files containing data over one year old will result in that data being shown in either the current or previous year, but no earlier than that. For this reason, it is recommended that you archive the log file at least once a year. The DoorStop X firewall provides ways of doing this automatically, manually or using AppleScript; other firewalls may provide different facilities.

Choosing another log file

Once Who's There? has started up, you can specify a different log file for processing in two ways:

• Choose Who's There? > Preferences, click the General button in the Preferences dialog, click the "Browse..." button, locate a file, and click "Open". When the Preferences dialog is closed, the new log file will be processed. Also, the log file will be opened by default from then on, until another log file has been specified. Note that when the Browse dialog first appears, it is pointing to the folder /var/log, where OS X's built-in firewall technology writes its log file (either system.log or ipfw.log). Once you navigate out of /var, you can only get back by
  • Typing cmd-shift-G with the browse window still open, and then entering "/var/log", OR
  • Closing the Browse dialog and reopening it.
• If you want to temporarily open another log file, but not change the preference setting, use File > Open.

Be sure that the file you locate is a firewall log file in the correct format -- other text files will be opened, but will display no data. Note that if you choose a log file generated by a firewall on another machine, the advice presented by Who's There? will only be accurate if the other machine is running a similar version of OS X. The security risks of OS X differ from those of other operating systems.

You can also override the default log file that Who's There? is set to process when it runs. To do this, hold down the option key when running Who's There? You will be presented with the log file Browse dialog, from which you can choose a new log file. That log file will be processed and then become the default until you change it.

Email template

The template used to create an email draft is displayed in the section labeled "Email Text". When an email draft is created, the "Subject" and "Body" fields of the template are inserted in the corresponding fields of the draft, with the following changes:

• Any occurrence in the template of "#IPADDR" will be replaced with the accessor IP address.
• Any occurrence in the template of "#MYADDR" will be replaced with the current IP address of the machine running Who's There? The machine's current IP address, however, may not be meaningful for a number of reasons. If your machine is on a home network connected to the Internet by a router (15, Home Routers), that router may well be performing Network Address Translation (NAT) (15, Home Routers). NAT provides your machine with a private IP address, which is not meaningful to the outside world. In this case, you may wish to obtain your router's IP address, and replace the MYADDR field in the e-mail with that address. See your router's documentation for details of obtaining its IP address.
  
  Another reason your machine's current IP address may not be meaningful is if the access attempts took place at a time when your machine had a different IP address, for instance due to its being connected to the Internet in a different way, such as at work or in a public wireless hot spot.

The actual email draft also includes up to 100 sample log lines, inserted after the template text. Also, lines are added at the end of the email, one of which refers to the time zone of the machine running Who's There. Be sure, using the Date & Time System Preferences dialog, that the Time Zone setting is correct.

Display preferences

The Display pane of the Preferences dialog (Figure 2) is used to specify items displayed in the Access History window and how they are displayed. Except as noted, these settings affect only the Access History window, and not the Summary by IP Address or Summary by Service windows. Each item is discussed in a separate section below.

Icon size

The service icons displayed in the Access History window are 16 x 16 pixels by default. If you wish to change the icon size, use the "Icon size" slider. For small icon sizes, the text size will be changed, too.

Highlight new lines

By default, Who's There? highlights (with bold type) new lines in the Access History window (and the two "Summary by ..." windows) until they're 15 minutes old. You can change that period with the "Highlight new lines for" popup menu.

Omit duplicate lines

By default, the Access History window displays all log lines that match the filter criteria. For doing certain types of log file analysis, you may find it useful to eliminate duplicate log lines. That is, if there are 500 lines for incoming access attempts from IP address 192.168.1.103 to port 80 on your machine, you may wish to see only one log line for that combination of accessor IP, port number and direction on your machine. To do this, check the "Don't show duplicate lines" checkbox. You will see only one log line for any set of adjacent lines where each line is an identical combination of

• source IP address (the accessor's IP address) (6, IP Addresses and Host Names)
• destination port (the service on your machine) (6, IP Port Numbers)
• in/out (incoming or outgoing access attempt)
• mode (TCP, UDP, ICMP) (6, Protocols)
• action (allow, deny) (12, Firewall Basics)

Columns

The default columns displayed in the Access History window are the ones checked in Figure 2. If you wish, there are additional columns you can have Who's There? display, by checking the appropriate checkbox.

• Emailed - This column contains a checkmark if email has been sent regarding the particular IP address. All currently displayed instances of the IP address are checkmarked at the time email is sent. If lines in the log file are not displayed in Who's There, due to data filtering, those lines will not have checkmarks if they are later displayed. To clear all checkmarks, use the "Clear" button next to this checkbox.
• In/Out - The direction of the access attempt: coming into the firewall machine, or going out. Incoming access attempts represent the greatest risk for Macintosh users; outgoing attempts, usually not blocked or logged by your firewall, are typically due to user actions such as Web surfing, or certain system operations, but may sometimes happen with Trojan Horses or other malicious software.
• Source Port - The port number on the accessing machine from which the access was attempted. (6, IP Port Numbers)
• Destination IP address - The IP address on your machine to which access was attempted. Most users' machines have only one IP address, so this field will be the same as "IP address" above. (6, IP Addresses and Host Names)

You can return the columns settings to their default values by clicking the "Reset to default columns" button. Note that all columns, even those not displayed, can still be filtered on using the Access History window's filter field.

Lookup IP address (6, IP Addresses and Host Names)

To get information on any IP address, regardless of whether it appears in your firewall's log file or not, use "Lookup IP Address..." in the Edit menu to bring up the Lookup dialog, shown below in Figure 3. Enter the IP address and click the Lookup button or hit the Return or Enter key. The Who's There? dialog will appear, displaying the appropriate information.

Online Help

Online help is available in two ways:

• From the Mac Help item in the Finder's Help menu.
• As an item in the Who's There? Help menu.

Either method will invoke online help for Who's There, which is structured much like this User's Guide.

Back to Table of Contents
Back to Who's There? Dialog
Forward to Accessing the Book, the Blog and Twitter