[Guide Home]

The Web Hikers guide to
Outpost Firewall

 

Home > The Outpost GUI > Plug-Ins > HTTP Log

Presentation

[Green colours with tiny sized fonts] [Green colours with medium sized fonts] [Green colours with large sized fonts]

[Orange colours with tiny sized fonts] [Orange colours with medium sized fonts] [Orange colours with large sized fonts]

[Blue colours with tiny sized fonts] [Blue colours with medium sized fonts] [Blue colours with large sized fonts]

[Grey colours with tiny sized fonts] [Grey colours with medium sized fonts] [Grey colours with large sized fonts]

Update Alert
Popup Glossary

About Presentation

HTTP Log

Bottom

The HTTP plugin options

Unlike the other plugins, HTTP Log doesn't have many options to customise except for a few options in the plugins context menu: Verbose and a limit on the size of the log generate by HTTP Log.

[HTTP Log context menu]

What the log is for

The log will provide you with very detailed information that the Allowed log won't provide. The Allowed log will just show the initial HTTP request (like to Google when you visit the Google search engine), where as this plugin will show you all the additional requests in the HTML like the location of images of files etc. Below is an example of the log, the Allowed log would have just shown a connection to www.agnitum.com but the page there has all kinds of links for images and style sheets etc. that this plugin reveals.

[Log sample]

Below is a sample of the log in Verbose mode:

[Log sample in Verbose mode]

Glossary Bottom Top

HTTP Log's Log

There are 5 columns in HTTP Log's log

  1. Date/Time
    This is the Date and Time that the Application caused the Event to occur.
  2. Application
    This is the name of the application that made the HTTP request.
  3. Event
    This is what type of request is being logged.

URL is the address of the web page you accessed as well as addresses of images/scripts in those web pages.

REQUEST are header field sent by your browser to the server.

ANSWER are header field sent by the server back to your browser.

  1. Data
    This will usually be the URL accessed unless you have Verbose on, in which case you will see all the headers and referers sent back and forth between you and the server. Some of the more common entries you will see in Verbose mode are:

Requests:

ACCEPT This is the image and other file formats that your browser can accept.

ACCEPT-ENCODING These are the different methods of packaging the files that your browser or client can accept.

ACCEPT-LANGUAGE These are the languages that your browser or other client can accept.

COOKIE The name of the Cookie you sent out and it's content.

CONNECTION Keep Alive This is sent by your browser to tell the HTTP server that you have other requests and not to terminate the connection you have established after the current resource you have requested has been made. Keep Alive speeds up your browsing and is a feature of HTTP version 1.1. Previous versions required you to make repeated request and wait for those connections to be established for everything. So each time you tried to download an image that was part of a page your browser would have to look up the domain again and send it a new request.

GET Get requests are things that can be cached by your browser and can be repeatedly downloaded by you if needed, images for example

HOST This is the host name of the web page your are visiting (in the above pictures it is www.agnitum.com).

IF-MODIFIED-SINCE This is sent by your client with a date. This is the date your browser last visited that site, this tells the server to only send you the page if the site has changed since then. If it hasn't changed your browser will show its cached version.

REFERER The location you came from to the current page you have just requested in your browser.

USER-AGENT This is the browser you are using (other programs that use HTTP may have identify themselves differently, GetRight will ID itself as GetRight and give it's version number for example). In the above image the USER-AGENT identifies my browser as Internet Explorer and the version of Windows I am running (at this point referers and such haven't been blocked by the Content plugin so you can see all the info sent out by your browser.

Answers:

SERVER The Name and version of the web server.

DATE The servers Date and Time.

LAST-MODIFIED The date and time the web page was last modified. Used by your browsers cache when deciding whether to show a cached version or whether to get the server to send it anew version.

CONTENT-TYPE The type of data the server is sending you.

ETAG Used by your browsers cache to check whether the contents of the page has altered.

CONTENT-LENGTH The size in bytes of the files being sent to you.

SET-COOKIE A request to your browser to store the information contained in this header and send it back to this sever the next time you visit the web page. Delete this, and your browser will never receive any cookies. In the Set-Cookie filter, the URL match can be used to selectively accept cookies. Also Proxomitron can make cookies "session only" so they're not permanently stored by your browser. Often this will work better at places where killing the cookie altogether will cause a site to complain.

  1. Application Path
    The full path to the application named in the Application column.

Download HTTP Log (This is always the latest version)

GlossaryTop

 

Outpost and the Outpost logo are ©Agnitum Software

This is an unofficial guide, the information expressed here may differ from Agnitum's. There is a support forum (no longer run by Agnitum, but by users) if you need more help this is a good place to start. Where information here conflicts with what Agnitum have told you always go with the information given to you by Agnitum.

 

Guide/site and images ©Stephen Cox