tcpTrigger Changelog

What's new in tcpTrigger 1.3.5

Aug 7, 2023
  • Major changes:
  • A new dedicated Windows event log is used. You'll find it under Applications and Services Logs > tcpTrigger.
  • Rogue DHCP detection was removed. It required too much tuning to be effective and would still result in false positives.
  • Minor changes:
  • [Service] Emails are now sent asynchronously.
  • [Service] Default buffer for email notifications changed from 15 seconds to 30 seconds.
  • [Service] Default rate limit for email notifications changed from 180 seconds to 300 seconds.
  • [Monitor] Fixed an issue where sometimes the tray icon would remain present after exiting.
  • [Monitor] The exit to tray option is now enabled by default.
  • [Monitor] When using the tray icon, it remains visible when the application window is open.
  • [Monitor] Limit the number of events displayed to 10,000.
  • [Monitor] Minor styling changes.

New in tcpTrigger 1.3.4 (Jan 16, 2023)

  • Fix for installer failing on non-English Windows installations.

New in tcpTrigger 1.3.3 (Jan 15, 2023)

  • Fixed an issue where sometimes the tcpTrigger service would fail to start during Windows boot.
  • Added a prerequisite check in the installer to ensure .NET Framework 4.5 or greater is installed.

New in tcpTrigger 1.3.2 (Sep 16, 2021)

  • Changes:
  • tcpTrigger (service):
  • Added SMTP server option to use STARTTLS for email notifications.
  • tcpTrigger Manager:
  • Added new Status tab. The Status tab shows the current state of the tcpTrigger service and gives the option to stop and start the service. Diagnostic and status events reported by the tcpTrigger service are read from the Windows event log and displayed in real time. This way you don't have to go through the Windows event viewer for retrieving diagnostic information.
  • Added SMTP server option to use STARTTLS.
  • Various minor UI changes.
  • tcpTrigger Monitor:
  • Added a quick filter directly on the title bar. Type to filter results.
  • Added link to tcpTrigger Manager in the options menu.
  • Change to run as a single instance application. If you try to run a second instance, the first instance is brought to the front. This is helpful since this application minimizes to the tray.
  • Various minor UI changes.

New in tcpTrigger 1.3.1 (Sep 2, 2021)

  • tcpTrigger (service):
  • Added ability to whitelist source IP addresses. Whitelist can also be specified by source_ip:destination_port combo.
  • Added ability to detect UDP connections.
  • Added option to log to a text file.
  • Email notifications are now buffered. When an email is sent, you receive a log of all connections that occurred during the short buffer period. Then if rate limiting kicks in (max one email every three minutes, for example), the connection log continues to record and is sent when the rate limit time is up. You will no longer miss a single log with email notifications.
  • Option to exclude network interfaces.
  • Removed name poison detection. This feature worked well, however, I felt it did not fit in well with the rest of the application as it required putting packets on the network.
  • Improved rogue DHCP detection. It detects other clients on the network communicating with an unrecognized DHCP server, even if your machine does not see packets coming from the DHCP server.
  • tcpTrigger Manager:
  • This is the graphical utility for managing settings for the tcpTrigger service. It has been completely re-designed to be simpler to use and easier to understand. It includes built-in documentation of every option available and a deployment guide for getting the best use out of tcpTrigger.
  • tcpTrigger Monitor:
  • This is a new optional utility that provides a real time view of tcpTrigger detection logs.
  • Utility can minimize to the system tray and pop up when new connections are detected.
  • Other notes:
  • All pre-compiled binaries and the installer are now code signed.
  • .NET 4.5 or greater is required.
  • The installer is now a 64-bit msi.
  • If you are upgrading, all of your previous settings are removed. The application uses a new XML-format settings file.

New in tcpTrigger 1.2.4 (Oct 24, 2017)

  • Added support for specifying ranges of TCP ports to monitor. Ranges are separated by a hyphen. Example: 21,23,2000-3000,3389 - This would monitor ports 21, 23, 2000 through 3000, and port 3389.
  • User settings are now preserved when upgrading to a new version.
  • Minor bug fixes and improvements to the editor.

New in tcpTrigger 1.2.2 (Oct 24, 2017)

  • Added the ability to customize alert message bodies from the GUI.

New in tcpTrigger 1.2.1 (Oct 24, 2017)

  • Fixed an issue where the installer would fail if it could not add an inbound firewall rule for tcpTrigger.exe.
  • Fixed an issue where the installer sometimes wouldn't correctly register tcpTrigger as an Event Log source.

New in tcpTrigger 1.2.0 (Oct 24, 2017)

  • Rogue DHCP server detection.
  • Added #DESTINATIONMAC# variable for use in message bodies.
  • Rate limiting is now per network interface.

New in tcpTrigger 1.1.1 (Oct 24, 2017)

  • LLMNR name poison detection.

New in tcpTrigger 1.1.0 (Oct 24, 2017)

  • NetBIOS name poison detection.
  • Option to display a popup notification on triggered alerts.
  • You can now define a different message body for each trigger type (ping, tcp syn, name poison).
  • Message bodies cannot be set in the graphical editor in this release, but you can set them in tcpTrigger.exe.config