Installing KFSensor

Installing WinPCap

KFSensor's Network Protocol Analyzer feature makes use of the WinPCap library.
WinPCap is the industry standard network packet capturing library and by using it KFSensor can work along side other security software such as Wireshark.

KFSensor will work without WinPCap being installed but functionality associated with the Network Protocol Analyzer will then be disabled. It is best to download and install WinPCap before installing KFSensor, though it is also possible to install it later.

Important Note
KFSensor will only work with certain WinPCap versions. Check the KFSensor download site for more information.

The WinPCap installation program can either be obtained from the KeyFocus web site or direct from the WinPCap web site:

See the Network Protocol Analyzer Administration section of the Advanced Service Configuration section of this guide for more information.

Running the KFSensor set up

To install KFSensor you must be logged on with full administration rights to the local machine.

In the next step you will be asked to choose the folder where KFSensor should be located.
The "Program Files" path is a good place to install KFSensor as it inherits a high level of access security. This is explained in the next section.

After selecting the program group where KFSensor should be installed in the Start menu, the installation will begin.

You will need to restart your machine before KFSensor can become operational.
You should register your copy of KFSensor within two days to make it fully operational.
You can then either start using KFSensor straight away or complete the secure aspects of the configuration, as described in the next section.

Log Path

The first time KFSensor is run it creates a log folder.
The default location of the folder is "C:\kfsensor\logs".
It does this to keep the logs in a separate area from the program and configuration files to improve security.

Un-installing KFSensor

You can uninstall KFSensor by taking the following steps.
  1. If you have installed KFSensor as a systems service then you will need un-install it first.
    Within the KFSensor monitor application select the "File -> Service -> Un-install System Service" menu.
    Then exit the KFSensor monitor application.
  2. Go to the Windows Control Panel and select "Add or Remove Programs". Select KFSensor and press the "Change/Remove" button.
  3. The un-install program will not remove the log files generated. If you want to remove these then you will need to locate and delete the KFSensor log directory with Windows Explorer.

Next: Choosing the database system

KFSensor On-Line Manual Contents