Firewall Kernel Mode Tool

The Firewall Kernel Mode Tool can be used to analyze and troubleshoot firewall connectivity issues by monitoring the ISA Server kernel-mode driver (fweng.sys).

A set of command line options provide a way of looking at low-level driver activity, at a specific point in time. View connection and creation elements, open and close firewall access for a specified IP address range, print information about specific connection elements, and filter lists. You can also export the output to an XML file.

The Firewall Kernel Mode Tool (FWEngMon.exe) provides a way of looking at some of the elements of the kernel-mode driver, to help you understand what’s going on at the low-level drivers, at a specific time. The first part of the document describes how to use the tool. In the section Kernel Driver Elements, you can read more about connection rules, connections, and creation elements.