Traffic Monitoring via Raw Sockets
Raw Sockets lets RdpGuard monitor network traffic without installing an additional capture driver such as WinPcap or Npcap. It is available for protocols that support traffic monitoring, but may affect performance on busy servers or fail to work with third-party firewalls and security software. We recommend WinPcap/Npcap for traffic monitoring.
Choose the server's local IPv4 addresses that receive connections to the protected service. RdpGuard monitors the ports configured in that protocol's settings.
Run RdpGuard Dashboard as administrator and open the protocol's settings under Monitored protocols. Enable protection and select Traffic if the protocol offers a choice between logs and traffic monitoring. Select Raw Sockets, then click its Configure... link.
The Raw Sockets Configuration dialog will open:
Raw Sockets Configuration with example IP addresses. Choose which local addresses to monitor:
Monitor all local IP addresses - monitor all active local IPv4 addresses. This is the default; monitoring many addresses may increase load.
Monitor selected local IP addresses only - enter the local IPv4 addresses used by the protected service, one per line. Each address must be assigned to this server. Remote client IPs, IPv6 addresses and address ranges are not supported here.
Click OK to confirm the addresses, then click Save in the protocol's settings to apply the changes.
If monitoring does not work, check the selected addresses and protocol ports, then open View, Show event log for capture errors. After changing the server's IP addresses, update the selected list if needed and restart the RdpGuard service through Tools, RdpGuard Service, Restart.
On Windows Server 2008 and earlier, use WinPcap/Npcap instead: Windows does not expose the outgoing packets needed for detection to this capture method. See Microsoft's Raw Sockets capture documentation for details.
RdpGuard protects:
- Remote Desktop
- MS-SQL Server
- FTP Protocol
- HTTP Protocol
- IMAP Protocol
- POP3 Protocol
- SMTP Protocol
- IIS Web Login
- MySQL Server
- ASP.NET Forms
- RD Web Access
- VoIP (SIP Protocol)
- SSH Protocol
- MS VPN (RRAS)
"This sotware is really great. It's a relief. Because my server is constantly under attack. Thanks RdpGuard" - Joaquim De Sousa Marques
"Nice product. I used to implement something similiar in a low-tech and cumbersome manner via a script called TSBlock (not mine). This makes it much easier and is well worth the pricetag for SMB's." - J. Johnson
"Absolutely amazed at your product. We are a church in the North Dallas area, and I discovered this morning multiple failed logon attempts via our Remote Access Server. A friend suggested your product, so I immediately downloaded the trial. It had a list of about five blocked IP addresses in minutes, and that was enough to lead me to push the BUY button. Over the past 10-15 minutes the list is now about thirty with at least a third being international attempts to break into our system. Thanks for a great product. You may have just saved us much grief." - John Hallford
"Love the software. RDP on our Windows servers is just ridiculous. We would block it in the router but we have lots of old-time customers that would have issues." - Scott Hirsch
"Love the software! Makes it easier than tailoring VB Scripts!!" - Nick Brennan
"It's a great product - really stopping those RDP attackers :-)" - Dave, UK
"First of all: Your application is very (!!!) useful and I like it very much securing my 2012 R2 server. RdpGuard is the best solution, I found on the market and after 10 minutes of testing it I ordered the fully-featured version. :-)" - Carsten Baltes