What's new in version 0.97?

Message summary

Reptor can now print a summary of messages other than statistical information (type 121). This can be useful for determining, at a glance, possible abuse of the firewall. For example, possible port scans (type 347), unauthorized protocol commands (type 334), or attempts to access control ports (type 515) might warrant further investigation.

Historical activity summary

Reptor can now accumulate daily activity statistics in a history file. A summary has been added that graphs the contents of this file. Alternatively, it could be easily graphed with external programs such as gnuplot or Excel.

Color highlighting

Reptor can now highlight alternating table lines with different colors. This is done with style sheet classes (called odd and even) for the TD attribute.

Minor usability enhancements

Reptor no longer requires an explicit "+" on ascending sort identifiers in the configuration file.

Reptor will exit with an error if it encounters an unprocessable configuration file directive.

Bug fixes

Fixed a spelling error.

Fixed the mail output subject line when processing cut logfiles.

Fixed a bug where the user summary wouldn't work unless the alert section was also included.

What's new in version 0.96?

Logfile compression

Reptor can now read compressed logfiles. The decompression program can be specified with the uncompress configuration file option. Also, files that are saved (as specified by the save_logfile option) can be compressed. The program to perform this compression can be specified with the compress option.

Support for cut/merged logfiles

The firewall creates each new logfile with a specifically formatted first line. Previously, Reptor required this line to be present. This caused problems if logfiles were cut into multiple pieces or if multiple logfiles were merged into a single large one. Reptor now specifically supports these situations by not requiring this special first line, and gracefully adapting the output if it is not present. A new command line option --ignore can be specified to indicate that the logfile to be processed has been cut or merged. This will cause Reptor to not look for the first line, and ignore it if present. This feature allows Reptor to report on a time period less than one day by feeding it a cut logfile, or on a time period greater than one day by feeding it merged logfiles.

Normally, if output file or output ftp is specified without a filename, Reptor will use the datestamp from the first line of the logfile to automatically generate one. If this situation exists when the --ignore option is specified, Reptor will default to a filename of "reptor.html".

Verify save_logfile directory

If the save_logfile option is specified, Reptor will verify that the specified directory actually exists.

What's new in version 0.95?

GNU GPL

Reptor is now released under the GNU General Public License.

User summary

A new summary has been added that shows usage by user. This is typically only useful if users authenticate against the firewall.

Top level domain summary

A new summary has been added that shows usage by top level domain.

Raptor Mobile summary

A new summary has been added that shows the number of connections made by Raptor Mobile clients. Since there is no way to determine when the tunnel was closed, it is not feasible to report on the tunnel traffic itself -- only the number of connections made is shown.

Save local copy of logfile

If you're using remotelog to retrieve logfiles, you can specify the new save_logfile option in the configuration file to indicate that you want Reptor to make a local copy of the logfile for additional analysis or backup.

New path parameter for remotelog option

If you are using the remotelog utility to retrieve logfiles from your firewall, and the remotelogfile executable is not in your shell's PATH, you'll need to specify this so Reptor knows where to find it.

Check for remotelogfile program

If the remotelog option is specified in the configuration file, and Reptor is run with the --verify command line parameter, Reptor will abort with an error if the remotelogfile program does not exist or is not executable.

Passive FTP transfers

The FTP output now uses PASV mode for compatibility with Raptor v6.

New options for email output

New mail_from and mail_server options in the configuration file allow you to specify the from address and SMTP relay if you're using email output. This may be necessary to avoid problems with anti-spam features of some email servers.

Style sheet option

A new style_sheet option in the configuration file allows you to specify a style sheet to be embedded in the report.

Bug fix

Fixed code to recognize directory names ending with \ and not just /.

Version option

A new --version command line option has been added. Guess what it does.

What's new in version 0.91?

Support for Raptor Firewall version 6

Reptor now understands the format of logfiles generated by Raptor Firewall version 6.

WebNOT ratings alert

Reptor can be configured to generate an alert message for connections that trigger a WebNOT ratings denial. This can be specified with the new configuration file option ratings.

New fields available in alert section

The alert section can now optionally contain the logfile fields "rule", "id", "op", and "result". These are specified with new configuration file options show_rule, show_id, show_op, and show_result.

What's new in version 0.90?

Extended configuration file options

Almost all command line options have been replaced with configuration file options. No more huge command lines! A few command line options remain in order to allow overrides of the configuration file settings. These remaining options have been changed to the GNU style long format. For example, -d is now --date. Refer to the About Reptor page for details.

Automatic local/remote host discovery

The configuration file local option has been removed in favor of the interface option. Instead of providing a list of IP addresses that are considered to be "local", you must specify what network interfaces exist in the firewall server. Reptor will then automatically determine which hosts are local and which are remote based on what interface they reside behind.

Traffic filter by interface and direction

Traffic can now be filtered by direction and by interface. If you have more than two network interfaces in the firewall server, you may want Reptor to ignore certain traffic, such as "from the DMZ interface to the outside interface" or "from the inside interface to the DMZ interface".

Remotelog support

Reptor can now obtain logfiles through the remotelog utility that is provided with the firewall. This allows Reptor to be run on a machine other than the firewall server without the need for customized scripting to transfer the logfiles, and without the fear of the logfile content being sniffed from the network.

Total summary

A new simple summary has been added that shows total traffic through the firewall.

Alert summary

A new simple summary has been added that shows how many alerts each host has triggered. This makes misuse tracking a bit easier -- a host that triggers two or three alerts is probably nothing to worry about, but a host that triggers fifty seven calls for further scrutiny.

Time of day summary

A new summary has been added that shows the amount of traffic based on the time of day.

Time of day alert trigger

Logfile entries can now trigger alerts based on the time of day, and can be separately defined for each protocol.

Graphs

Summary tables can now optionally include bar graphs to indicate traffic as a percent of total.

Configurable word search fields

You can now specify which fields are included in the word search. The string that the word search scans can be built from any combination of source host name, remote host name, and connection argument. (The connection argument is the value from the logfile "arg" field, which typically contains the URL.)

Reverse DNS lookups minimized

Reverse DNS lookups can now optionally take place only if a host name actually gets included in the output. Doing this is dramatically faster than performing a lookup on every unresolved IP address, and only slightly slower than not doing any reverse lookups at all. However, the drawbacks of this option are that the hostname will not be able to be included in the word search string, and that summaries will not be able to be sorted by hostname.

Default style sheet

The HTML output now includes settings defined by a default style sheet, to allow easy customization of report aesthetics.

Optional hyperlinks

Hyperlinks are now optional. New links have also been added before each report section to allow easy navigation.

Automatic version detection

Reptor will now automatically determine the firewall version you are using.

Time alert renamed

The time alert option has been renamed to duration.

Size alert renamed

The size alert option has been renamed to volume.

Bug fixes

Summaries now correctly count the limit of number of entries, and durations greater than 23:59:59 will now display correctly.

Additional optional alert section fields

The alert section may now contain additional optional fields, individually selectable. These include: the reason for the alert, the user, the argument of the connection, and the authentication method used.

Removed non-HTML output formats

The plain text and delimited text output format options have been removed.

Allow aliases with spaces

Aliases may now contain spaces.