Link Logger Home ZyXel Banner Binary Visions

Link Logger for Windows
Home Home Product Info Product Info Download Download/Purchase Support Support  
Link Logger for Windows

Screen ShotsScreenshots

Customer CommentsFeedback

Common ScansScans

Additional ResourcesResources

Additional ResourcesMy Articles

My BlogMy Blog

  • December 20, 2011 - Link Logger still active and supported.
  • Its been almost 12 years now since I released Link Logger and thousands of users around the world, both home and corporate are using Link Logger and I have to admit it always makes me happy to hear from some of our very earliest users and that they are still using Link Logger after all these years. I am very proud of Link Logger and always happy to assist Link Logger users. I like being a small software shop where as a the author of the software I personally provide support for the product as the other day I contacted one of the major hardware vendors on behalf of one of our users and it killed me that their support tech had no idea what 'Syslog' was when I asked him if one of their products supported it.
  • July 15, 2008 - Link Logger for the Netgear FVS336, FVS336g, FVX538 and DGFV338 Models.
  • A new version of Link Logger was created to support the Netgear FVS336, FVS336g, FVX538 and DGFV338 Models and is available for download on our download page. This version of Link Logger was made possible after some 'long discussions' with Netgear to 'upgrade' the logging functionality within their firmware.
  • July 15, 2008 - Link Logger for the Netgear FVS124G.
  • A new version of Link Logger was created to support the Netgear FVS124G run that latest and likely the last firmware release from Netgear and is available for download on our download page.
  • January 19, 2008 - Link Logger for the Linksys RVS4000 released.
  • A new version of Link Logger was created to support this Linksys product line and is available for download on our download page.
  • January 1, 2008 - Blake McNeill awarded as Microsoft MVP for fifth year.
  • I am very excited about this as I've been moved into Visual Studio - Security group after spending 4 years on the Windows Security group. I've always considered myself a coder and now I get to focus on coding and security, best of both worlds and what I feel is the 'next' challenge in security.

  • December 20, 2007 - Sorry for letting my News get behind.
  • Wow have I ever been slack on keeping up with my News. I have been posting some new versions of Link Logger lately including Linksys WAG200G and Netgear FVX538v1, FVS338, FVS124G Models as well as posting some updates for existing versions of Link Logger. So while I've been slack on posting news, I haven't been slack on Link Logger.
  • On November 20th I did my first webcast as part of the Microsoft Ignite Your Code Webcast series (ya I know that is a sad picture of me, just there are not many photos of me in existence, thankfully). I did the presentation on Windows Security Essentials and you can download my demo code from here

    The Demo Code includes examples on how to code
    • DACLs/SACLs
    • Impersonation
    • Implicit/Declarative Code Security
    • Code Access Security
    • Asymmetric/Symmetric encryption

    The webcast includes an introduction into how Windows implements security and then how to include security into your code. I hope you enjoy and learn something helpful.

  • How to setup and use a virtual computer to capture and analyze Malware.
  • January 1, 2007 Blake McNeill awarded as Microsoft Windows Security MVP for a fourth year.
  • Again a special thanks goes out to everyone who I'm able to keep learning from and sharing with and especially the great security community on Broadband Reports.

Microsoft MVP logo

  • One of the most common questions we hear is what is the inbound traffic on UDP port 1026, 1027, 1028 etc, so this article will help you understand what Messenger Spam is.
  • January 4, 2006 Blake McNeill awarded as Microsoft Windows Security MVP for a third year.
  • A special thanks goes out to everyone who I'm able to keep learning from and sharing with and especially the great security community on Broadband Reports.

Microsoft MVP logo

  • An article to help users understand the recently detected windows metafile exploit and how to defend against it.
  • December 22, 2005 - Link Logger for the FVS318 v3 released.
  • A new version of Link Logger was created to support the FVS318 v3 and is available for download on our download page.
  • An article to help users detect attacks or infections on their systems.  Contains a link to our 'DMZ Danger' bulletin.
  • In response to all the claims about NAT not being a worthy security device a challenge was issued to anyone who thought they could hack past anyone of a number of consumer grade routers and firewalls.  A very popular thread with some interesting findings.
  • Spring/Summer 2005 Don't forget to check Link Logger's online updates as we have been releasing free online updates for Link Logger v2.x including new reports, features, enhancements, bug fixes and alert updates.
  • Thus far we have released updates for Linksys nonProtocol, Protocol, WRT54G and WRV54G RV0xx versions, Netgear Fx114y version, ZyWall 3.62 version and will continue to release updates in the future, so please check Link Logger for updates.

  • January 1, 2005 Blake McNeill awarded as Microsoft Windows Security MVP for a second year.
  • Once again I'd like to thank Microsoft and hope I can continue learning and sharing with others in the Security community.
  •   You can see my MVP profile and picture (Brad Pitt isn't to worried about me swiping his job with that picture) at Microsoft's MVP Directory.  I am also involved in running the Calgary Delphi Users Group as my principle passion is designing and building software and I've been lucky to practice my passion now for over 15 years.  Delphi rocks, but I must admit that Visual Studio 2005 rocks as well.  Great time to be a developer as the tools are truly getting better, thanks Borland and Microsoft.

    MVP Logo

  • December 29, 2004 Link Logger now supports Linksys WRT54G and WRT54GS firewalls running suitable third party firmware.
  • A new version of Link Logger was created to support this popular Linksys model line running suitable third party firmware such as HyperWRT and SveaSoft is available for download on our download page.
  • December 29, 2004 Link Logger now supports Linksys WRV54G, RV016, RV042 and RV082 models.
  • A new version of Link Logger was created to support this Linksys product line and is available for download on our download page.
  • October 22, 2004 Link Logger now supports Netgear FVS318 and FVM318 ProSafe Firewalls.
  • A new version of Link Logger was created to support the FVS318 and is available for download on our download page.
  • April 20, 2004 Link Logger now supports Netgear FR328S and FVL328 ProSafe Firewalls.
  • Support for the Netgear FR328S and FVL328 was added to the Fx114y version of Link Logger.
  • New report added to all versions of Link Logger which create reports showing port users for both inbound and outbound traffic and both source and destination ports. You can use this report to see who is generating the most http traffic (ie who is surfing the most, outbound destination port 80 traffic), or to see the sources of your Witty Worm traffic (inbound source port 4000) or who is scanning you on each of a group of ports for example inbound destination ports 80,135,139,445,1025,2745,6129.
  • Other minor enhancements and bugs fixes as well are included in this release.
  • March 3, 2004 PortPeeker version available for download.
  • Added a number of minor features and the ability to have PortPeeker save captures to file. Also added an installer/uninstaller.
  • January 20, 2004 Link Logger Product Manager awarded 2004 Microsoft MVP for contributions to Security
  • Link Logger Product Manager Blake McNeill was awarded a MVP by Microsoft in Windows Server Systems for community contributions in Security over the past year. According to Microsoft, "Microsoft Most Valuable Professionals are individuals who are recognized by peers as well as by Microsoft for past credible participation, highest quality answers and a demonstrated willingness to share their Microsoft technical expertise with others while providing guidance and assistance in peer-to-peer technical communities worldwide." Blake has been very pleased to been able to contribute back to the security community from where he has learned so much himself and hopes to continue learning and sharing with others in the future.

MVP Logo

  • January 1, 2004 Link Logger version 2 released download.
  • New versions of Link Logger available for Linksys and Netgear firewalls/routers with a number of new features and enhancements
    • Online Updates including alerts
    • Daily Scheduled Database Maintenance
    • WhoIs Lookups
    • Send Messages
    • New Reports and Traffic Graphs
    • and much more
  • December 13, 2003 PortPeeker version available for download.
  • Fixed a bug which prevented PortPeeker from working correctly on faster P4 hyper-threaded systems.
  • October 12, 2003 Link Logger version for Netgear Fx114y ProSafe Firewalls available for download.
  • We fixed a bug concerning raw socket access when starting Link Logger as a non admin user on Windows XP, 2000, etc.  On start-up Link Logger pings the firewall to test connectivity and by default non admin users do not have access to raw sockets in Windows 2000, XP, etc so Link Logger would display an error message and not start correctly.  The fix involved changing the ping call to a system call with non admin users have default permission for.
  • September 14, 2003 Link Logger version for Netgear Fx114y ProSafe Firewalls available for download.
  • We fixed a bug concerning sorting by source port in the Traffic and History list where the list contained an ICMP event.
  • September 14, 2003 PortPeeker version available for download.
  • We added a number of small enhancements and a couple of new features such as WhoIs support, Hex editor now allows for binary responses for 'On Connect' and 'On Data In' Events and the ability to save responses, and captures to file.
  • September 6, 2003 DShieldUp update available for download.
  • Fixed a bug within copy/paste method of adding events to the non protocol (Linksys) version of DShieldUp.
  • September 1, 2003 DShieldUp update available for download.
  • Added support for SMTP servers requiring authorization.  Also fixed bug in pasting events into DShieldUp when time isn't in UTC format.
  • May 7, 2003 Link Logger awarded Editors Choice at
  • While we might submit our freeware tools like PortPeeker to download sites we never submit Link Logger to any download sites so when a respected site like finds Link Logger and thinks highly enough of Link Logger to list it on their site and give it their highest rating then we take it as a bit of a compliment, Thanks Web Attack.

  • April 21, 2003 PortPeeker available for download.
  • PortPeeker is a freeware utility designed for quick and easy use as a port listener.  PortPeeker which can listen for TCP, UDP and ICMP traffic and has a number of useful features like input text searches, list of connecting IP's, selectable event captures (connection request, connection made, data in, etc).
  • January 11, 2003, Link Logger version for Netgear Prosafe Firewall FR114P, FR114W and FM114P available for download
  • We are pleased to release a new version of Link Logger for the Netgear FR114P, FR114w, and FM114P Prosafe Firewall products.  This release of Link Logger contains new reports (Content Filter report for example) and a number of other Reporting enhancements.  Also include in the new features and enhancements is an automatic daily database compact/repair and backup function.  We are proud to support these new products from Netgear.
  • September 26th, 2002 Link Logger for Linksys BEFSX41 available for download
  • We are pleased to release a new version of Link Logger for the Linksys BEFSX41.  The BEFSX41 reaches a new level of logging functionality within the Linksys product line and we are now pleased to add it to our supported product line up.
  • September 9th, 2002 New version of the free DShieldUp utility available for download
  • Added 'Paste' support for adding logs into DShieldUp which allows for 'Copying' of logs from Link Logger into DShieldUp.  Also fixed a bug within the Zywall and Prestige/Netgear versions when upload non TPC/UDP traffic the destination IP address would be truncated by one character.
  • August 16th, 2002 Link Logger for Zywall Routers available for download
  • Made an adjustment in the code to account for a small difference in the logging output in the Zywall 50 (firmware versions V3.50(WC.3) and newer) which prevented Link Logger from working correctly with the Zywall 50.
  • August 12th , 2002 Link Logger 1.6.2 available for download
  • An enhancement to the Hostname Report where an individual internal system can be selected. This allows users to build a report for each internal system as to what web sites they have visited for example.
  • Fixed a bug concerning copy/pasting of individual rows from Hostname and Port IPs reports. 
  • July 29th, 2002 Link Logger available for download

This fix applies only to the Linksys version of Link Logger and is for where the hostname lookup buttons in the Event detail panel were reversed.

  • July 27th, 2002 Link Logger 1.6 available for download
  • A new report which shows number of unique IP address per day on entered ports.  This report is like the Port Traffic report where you can enter in a list of ports but Link Logger will show how many IP address hit that port per day, or on the outbound report how many unique IP addresses your 'network' went to per day.  For example you can see how many unique IP addresses scanned your port 1433 per day, or you could see how many unique IP addresses your users surfed to per day (port 80).  We added this report as were interested in just how many infected machines were scanning us and how this number changes over time.

  • A new report which shows the hostnames, hits, and last event date/time for a given traffic direction and optional port numbers.  For example if you wanted to see what web sites people have been going to from your network enter ports 80 (http), 443(https), and perhaps 8080(http - alt) and Link Logger will produce a report showing the hostname (if one exists), visited how many times, and when the last visit was for each site visited. If you want more detail, then double click on the row (site) of interest and Link Logger will load the recent history for that site.  You can also change the report to show you the hostnames of inbound traffic (ie who has been scanning your port 27374 for Subseven trojans).

  • New Silent Alarm Feature.  You can now have alarms emailed out, without having the Alarm Popup screen appearing.

  • Can refresh messages report with 'F5' or pop up menu item without having to exit the reporting window and restarting reports.

  • Eliminated delay on startup of the Report Screen.  The delay was to retrieve and load the list of internal IP addresses for the System reports.  This list is now created on first entry into either of the System reports.

  • Changed Reporting tab to show all reports in a two row tab such that reports are no longer hidden to the right.

  • Can set the port number for SMTP within Link Logger.  Default is 25, but if a different port is required enter the SMTP server name as: Server:Port

  • Can reset the Search screen back to its default values by pressing �F5� or clicking on Restore Defaults on the right mouse button popup menu.

  • Some code clean up.

  • May 13th, 2002 DShieldUp free utility available for download

DShieldUp is a free utility which enables Link Logger users to easily send their logs to  NOTE DShieldUp is a not an officially supported product, but provided free with source code available to those who wish to modify or otherwise improve it.

  • May 11th, 2002 Link Logger 1.5.1 released

Link Logger 1.5.1 contains two minor bug fixes.  The first dealt with converting time from UTC to local time using the 'Time Format' button in the Event detail panel.  The second bug occurred when reports were exported to HTML, where the text in the export was white which resulted in invisible text on the HTML report.  This update is FREE for registered users.

  • May 7th, 2002 Link Logger Nominated for the Isidor Awards for most popular shareware product in the 'Internet and Communications' category.  Voting goes to May 31, 2002.  Thank you for voting for Link Logger.
  • April 5th, 2002 Link Logger 1.5 released

Link Logger contains a selective database purge (reserved for registered users only), Select All and Copy (right mouse button pop up) for the Traffic and History lists, mmm date support, admin restricted privileges for some features (pause logging, purge, purge messages, email and router setup, only applies to NT, 2000, or XP users), and some other enhancement.  This update is FREE for registered users.

  • March 11th, 2002 Link Logger Product Manager member of the AttackNET Design and Operations team at InfoTech2002

Blake McNeill is a member of the Design and Operations Team for AttackNET presentations and will be involved in presenting hands on lab experiences concerning such topics as 'E-Commerce Lockdown', 'Backup, Recovery and Redundancy', 'Intrusion Detection, Incident Response, and Deception', 'Electronic Crime Scene Investigation', and 'Introduction to Auditing and Forensics' featuring use of Nebraska University's AttackNET simulator.

  • January 19th, 2002 Link Logger for the ZyXEL Prestige / Netgear released.

Binary Visions does it again and adds ZyXEL Prestige / Netgear routers to it's family of Link Logger supported products. Same high expectations are met with the same easy to use interface, reports, graphs, but now for the ZyNOS based ZyXEL Prestige products and Netgear routers.

  • December 15th, 2001  Link Logger for the ZyXEL ZyWALL released.

Binary Visions is pleased to release its newest addition to the Link Logger family of products.  Link Logger for the ZyXEL ZyWALL contains everything you have come to expect from Link Logger and more.  Same easy to use interface, reports, graphs, but with event protocol (TCP, UDP, etc), Blocked indicator, and additional search parameters are only the start.

  • October 1st, 2001 Link Logger 1.4 available released (build 287)

Link Logger 1.4 contains a new report which shows unique IP addresses per day.  This report can be used to see how many unique IP were inbound or outbound per day.  You can also set for alerts or normal traffic.  A sample of the graph is available on our screen shot page.

Another feature added to this release shows what version of the alerts and port services are being used.  This is shown as a database version within the the About Box.

  • September 26th, 2001 Link Logger Gnomed by Chris

Locker Gnome

  • September 10th, 2001 - Link Logger 1.3 (build 284) released

Link Logger 1.3 contains remote emailing of alerts and alarms to assist users in monitoring remote systems.  Also included are changes to increase the accuracy of outbound alerts (red and black alerts).

  • August 8th, 2001 - Link Logger 1.2 (build 279) released

Link Logger 1.2 contains three new reports. Port Traffic, IP Traffic, and Messages. Port traffic allows you to enter one or more ports and then see the frequency those ports were hit on a daily basis. The list of ports is entered as a comma delimited list. The IP Traffic report is similar, but for IP Addresses. The Messages report contains non logging messages from the Linksys Router, error messages or operational messages from Link Logger. You can purge these messages after your review.

- Added IP and Port ranges to the Search screen. You can now search for a ranges of IP addresses and ports.

- Removed the splash screen. No one seemed to like it so it was removed.

- Improved Sorting. You can now sort IP addresses by value as compared to string value.

- Enhanced the main screen layout and added horizontal sizing. Including counters and moving the display filters to the main screen.

- Audio support for alerts and alarms using user selected wav files. You can assign wav files to be played for each level of alert or for alarms.

- Added user options to disable outbound alerts (which have a high false positive count), or to omit event description when using drag and drop.

  • June 7th, 2001 - Updated MDAC to 2.5 SP2 version 2.52.6019.2.

The full Link Logger install now includes MDAC 2.5 SP2 (version 2.52.6019.2) from Microsoft.

  • June 1st, 2001 - Link Logger 1.1 released (build 264).

- Link Logger 1.1 features the addition of printing/copying/exporting of reports and graphs.  Graphs can be saved to Bitmap (bmp) or Windows Metafile (wmf) or Windows Extended Metafile (emf) format.  In addition you can copy/paste Link Logger graphs into your own reports.  Reports can be exported to ASCII, CVS, DOC, HTML, XLS, or XML format files, can also copy/paste Link Logger reports into your own reports as well.

- We also made a changed the Report window to be Modeless.  Which means you can leave it open while research events within Link Logger.  We also enabled some interaction between the Report Screen and Link Logger.  If you double click on a report row containing an IP Address (IP Usage Report, System IP Usage Report, or Alert Source Report) Link Logger will automatically retrieve the historical traffic for that IP.  This makes investigation of reported incidents much easier.  We would like to thank Ian and Margaret (both clients) for making these suggestions.

- Large Font support.  Link Logger now displays correctly when the screen display is set to use Large Fonts.

- We have also modified Link Logger to work correctly for 'user' level permissions on Windows NT and Windows 2000.

  • May 10th, 2001 - Link Logger build 261 released.

Build 261 contains a couple of minor bug fixes, and the following enhancements:

- Automatic resort of traffic events. This feature can be turned off ('Setup...'->'User'). This means that Link Logger can add new events to the top of the traffic list automatically.

- Ability to disable auto hostname lookups ('Setup...'->'User'). Sometimes looking up a hostname can send a message to the other system, possibly informing them that you are aware of them. This puts Link Logger into 'stealth' mode. You can still manually lookup a host name by clicking the button to the right of the name. 

- Link Logger now reloads the traffic list according to display filters. There is also a separate field to set the number of rows returned by a reload as compared to IP or Port histories rows returned ('Setup...'->'User').

- More information on the alarm screen.

- Link Logger remembers how it was last visually configured on the screen when it starts.

- Build 262 added a check to ensure that the display location was visible on screen (ie not displayed to the left of the visible screen).

  • April 6th, 2001 ** Binary Visions releases Link Logger version 1.0 **