TamoSoft: Network Analysis Tools & Security Software

Network Content Monitor - NetResident

NetResident Help Documentation Next Page

Configuring NetResident

NetResident configuration options are available under the Tools => Options menu. If you are a novice user or not familiar with networking, we suggest that you launch the Setup Wizard that will guide you through the configuration process.


The Options window has a number of pages responsible for the configuration of different aspects of the program's behavior.



Interface : General


Allows you to change the interface font settings, configure the update mode.


If you prefer NetResident to run in the background, you can configure NetResident to run minimized by checking the Show icon in the tray box. Additionally, you may want to enable the Hide from the taskbar on minimization option if you want to hide the application from the taskbar on minimization.


Please check the Enable automatic updates box to enable updates. Also, you can configure the interval NetResident will check for updates: enter the desired value in the Interval between checks, days field. Clicking the Check Now button will make NetResident check for updates immediately.



Network : Startup


This page allows you to configure the network monitoring function performed by NetResident Service.


If you need to monitor your network constantly, select the On Windows Startup option. When this radio button is selected, NetResident Service will be launched on Windows startup and start monitoring the network. You can launch NetResident and view the monitoring results at any time.


In case you use NetResident periodically and you don't need monitor your network all the time, we suggest that you select the On NetResident startup option. This will allow you to save some disk space and reduce the CPU load. If you select this option, the NetResident Service starts along with the NetResident application and network data collection will stop once you close the application.



Network : Targets


The Targets page has a drop-down list that allows you to specify the correct network adapter for monitoring the network. If your computer has a dial-up connection or is connected to the LAN via an Ethernet adapter, you will only have one adapter on the list. You will need to select it. If your computer serves as the Internet gateway for the LAN or has more than one network adapter, you will need to select the adapter that you would like to monitor with NetResident. Some network adapters cannot operate in promiscuous mode; if you use such an adapter please check the Use non-promiscuous mode box. This option must always be selected for wireless adapters. For dial-up and VPN adapters, please select the WAN miniport adapter.


If you would like to analyze network data from all computers on your network, please enable the Monitor all stations option. If you are on a busy network, you may wish to narrow the range of the stations that NetResident monitors. Click on the Advanced button and select the Monitor the stations listed below radio button. Check the boxes next to the selected stations. If the Advanced button is grayed out, disable the Monitor all stations option and the button will become available.


Monitored Stations




You can add a new station by clicking on the Add button and entering the IP or MAC addresses or a range of IP addresses. The Description field is used for entering any information about the added station(s). This field is optional.


Click OK to save the settings, or Cancel to discard the changes. Please use Edit and Delete buttons for changing or removing the stations on the list. If you want to disable the monitoring of a particular station temporarily, without removing it from the list, uncheck the box next to it.


You may also want to add active stations by clicking on the Pick Active button and checking the active stations discovered by NetResident:




Select the desired addresses by checking the corresponding boxes and click OK. The selected addresses will be added to the list of stations for monitoring.


Please note that the list of stations can be incomplete as some stations could be switched off or changed their addresses. Also, some stations could be hidden behind firewalls. Please use this list for your reference only.


If you are unsure whether you should choose MAC or IP addresses for identifying the monitored stations, please refer to the FAQ chapter.



Network : Plugins


This page displays the list of currently installed plugins used by NetResident. If you don't use some of the plugins, we suggest that you disable them by unchecking the respective checkboxes in order to reduce CPU load and disk space utilization.




You can also use the internal plugin filters for specifying additional filter criteria that would result in reducing the number of captured events (and, of course, disk space utilization). To change the filter settings, click on the Change button of the respective plugin. See more detailed information in the Plugins chapter of the manual.


Note: Only Web and Mail plugins have plugin filters currently.



Network: Ports


This page allows you to configure the port numbers used by NetResident for traffic monitoring.


By default, NetResident Service is configured to monitor traffic on all possible ports (1-65535). This ensures that all possible network data would be intercepted. However, significant CPU time is required to process all (even unwanted) intercepted network packets. If you experience performance-related problems, try to narrow down the number of ports used for data interception. For instance, if you monitor traffic on a local office network where most traffic is generated by transferring files from one computer to another by means of Microsoft Windows, you may want to exclude this traffic by entering the following line:




The line above disables monitoring of ports 139 and 445. If you don't know what network ports are or don't experience any performance-related difficulties when running NetResident, don't change any values on this page.


You can specify one or several ports separated by commas or a port range. Please note that the port exclusion will be applied to both source and destination ports.


Network: Remote connections


This page allows you to configure remote connections to NetResident service. Please see the Remote Connections to NetResident Service chapter for more information.



Network : Advanced


This page allows you to configure the program's logging behavior. The Enable service logging option is turned on by default and the logging is set to the Quiet level.  If you experience problems with NetResident, TamoSoft support team may ask you to change the service logging level if additional information is required. NetResident service messages are written to the DebugCWS.log file located in the application folder and TamoSoft support team may request that you send this file by e-mail. Please note that the log file may be considerable in size if the Verbose option is selected. Please always zip the log file before sending it to our customer support.


The Automatic import option that is available on this page is intended for automatic importing of the log files that contain captured network traffic. To enable this option, check the Enable automatic import box and select the folder that contains the required log files.


Note: The folder that contains the log files to be imported must be local, i.e. it must reside on the same computer where the NetResident Service is running.



Database: Common


NetResident has its own database that contains all captured and analyzed network information. Database files are located in the application folder by default. This page allows you to change the database location (if necessary for some reason). Select the desired folder where the database should be located and click Apply.



Database: History


Since the database contains records of all events captured by NetResident, the database size increases with time. To reduce space occupied by these records and increase the program's performance, you may want to enable the database size limitation mode by checking the Limit database size box. The Delete the events older than field contains the number of days NetResident will keep records. Older records are automatically deleted. Alternatively, you may want to archive old records instead of deleting them. To archive your records, check the Create archive copies in box and specify the path you want the archive records to be saved to. Use the Database Management Wizard if you want to restore previously stored archive records.


You can empty the database automatically each time you finish working with the program by checking the Clear the database on exit box.