Collect, View, and Analyze Router Logs
WallWatcher banner

WallWatcher support ended February 1, 2011.  The programs will remain available indefinitely, but without maintenance or enhancements, and no one is available to answer questions.

Download WallWatcher Version 3.3.37 (Final)
Related Programs
Download its library (new users only) January 1, 2011 GetLog  3.0.17       March 24, 2007
Previous versions  
WW2Dshield  3.0.17      Aug 23, 2008
Privacy Policy Recent Changes to WallWatcher    FAQ

    WallWatcher runs under all versions of Microsoft Windows released between 1998 and 2010, including Windows 7, VISTA, XP, 2000, ME, NT, and 98.

    It collects, displays, and analyzes log information from more than 135 Routers and firewalls made by: 2Wire, 3Com, Actiontec, Adtran, Airlink, Asante, Astaro, Asus, Bewan, Billion, Bintec, Buffalo, Checkpoint, Cisco, Cyberguard, D-Link, Draytek, Edge-Core, Edimax, Fortigate, Fortinet, Gnatbox, Hotbrick, IPCop, IPTables, ITServ, Juniper Networks, Level One, Linksys, Lucent, m0n0wall, Netgear, Netscreen, OpenBSD, ParkerVision, pfSense, Servgate, SMC, Smoothwall, Sonicwall, Speedstream, Squid, Symantec, Trendnet, Untangle, US Robotics, WatchGuard, Westell, Xincom, XroadsNetworks, Zoom, and ZyXEL(see details).  Many other routers use the same logging format as some of the listed ones, and WallWatcher can help you find the best fit.  For details, please see Router Selection, below.



Sample Screen
(Some columns and data are Router model-dependent)


Sample Chart
The green "bump" was the "SQL Slammer" worm attack in late January, 2003
You can select other time periods, other chart appearances, and other information


(Availability of bandwidth usage information is router-dependent)

    (and similar routers from the same manufacturers; if your router isn't listed, please see "My router isn't on the ROUTER list.  What should I do?" in the FAQ):

2Wire 1800HW, 1000SW, 1000HG, 2701HGB, HGV-B and similar
3Com Office Connect, SuperStack 3
Actiontec MI424WR; MI424WR Rev. E.
Adtran Netvanta 3448
AirLink AR325W (Firmware-dependent),  AR410W, AR525W
Asante FR1104G
Astaro 6.1, 7.0
Asus WL-500G, WL-500G Deluxe  (but not GX)
Bewan LanBooster 6104 (same as Draytek)
Billion BiPac 7404 VGOM
Bintec Bintec standard log format
Buffalo WBR-G54
Checkpoint VPN-1 Edge X
Cisco PIX 501, PIX 506, 506E, 515, FWSM, and similar;
831, SOHO 91 and similar; ASA 5505, ASA 5520
Cyberguard SG570, SG300
D-Link DFL-80, DFL-200, DFL-300, DFL-500, DGL-4100, DGL-4300,
DI-604 (Revision 'D' only), DI704UP, DI-804HV,
DIR-600 series, DIR-825
Draytek Vigor 2600, 2900 and similar
Edge-Core VR-50
Edimax BR6641
Fortigate 60
Fortinet 60, 200A
GnatBox 500 and similar
Hotbrick 401VPN, LB2, VPN 800/2
IPCop (IPTables-compatible)
IPTables many routers use variations of this standard
ITServ Rideway Station SOHO
Juniper SSG-20 (same as Netscreen 5GT / IPTables)
Level One FBR-1412TX, FBR-1418TX, WBR-3402B
Linksys BEF-series, WAG354G (UK and non-UK); HG200;
WAG54G (ver 1 and ver 2), WRK54G, and similar;
WRT54GP2, RV/WRV-series; WRV200; RVS4000;
WRT400N; WRT600N; WRT610N;
WRT54G and WRT54GL (with Sveasoft, DD-WRT, Tomato, or HyperWRT Firmware);
Lucent SuperPipe 155
M0n0wall version 1.1 (m0n0wall is a software firewall)
Netgear DG834GB, FR114P, FVG318, FVS124G, FVS318, FVS318G, FVS328,
FVS336G, FVS338, FVX538 (two versions), FWAG114, FWG114P, RT314
Netscreen 5GT, 5XT
OpenBSD Personal Firewall (software firewall)
ParkerVision WR1500
pfSense (software firewall)
Servgate Edgeforce Plus
Smoothwall version 2.0
SonicWall TZ170
Speedstream 4200, EN5100, EN5861
Squid (software firewall)
Symantec 200R, SGS 460
Tipping Point X-series
Trendnet TEW-432BRP TEW-633GR
US Robotics 9106 (IPTables-compatible), 5462
WatchGuard Firebox X Core series, Firebox X Edge series, X10E,
Firebox X Edge-E series, Firebox SOHO6, Fireware Pro
Westell Versalink 327W, 7500 (Verizon)
Xincom DPG 502, DPG 603
XroadsNetworks Edge Series
Zoom X5
ZyXEL 660HW, 2606HW, P320W, P334; Prestige 642 R-11,
650H-E7, 653 H1-11, NBG334W, X550;
ZyWall2, ZyWall5, ZyWall 70, and similar
If your router is not on this list, use "Auto-Select".
If none of its choices is satisfactory, try IPTables.
If that doesn't work, use 'SysLog (generic)'.


    WallWatcher supports most routers that send log records in real-time to a local computer port, usually 514 (SysLog) or 162 (SNMPTrap).  If your router can do that kind of logging, it's probably using a supported log format.  To find the best match, you can install WallWatcher and use the "auto-select" option on its ROUTER menu.  This one-time test may take an hour or two, depending on how much traffic your router reports.

    NOTE: if your router cannot send log records in real-time to a local computer, WallWatcher will not be able to support it.


    WallWatcher is Shareware, not "Freeware"; but the current price is $0.00.



    The WallWatcher website doesn't collect any information about you.  It does count the number of times certain pages are accessed, but not by whom.  The web servers that host WallWatcher belong to various companies, not to me.  They collect IP addresses, timestamps, and usage statistics (which pages and files you transfer, and how many bytes are transferred).  They do that so they can bill me if the monthly bandwidth quota is exceeded.  Some of those hosts make those weblogs available to me to prove they're not overcharging.

    The programs at this website are not, and never have been, Spyware, Adware, Trojans, etc.  The only information they collect is the log and bandwidth data from the Router(s) you've asked them to monitor.  That information is stored in log files on your hard drive for your review and use.  WallWatcher does nothing else with any information unless you tell it to send information from those log files to the DShield.org or myNetWatchman Security Collection Centers, or to send logs or intrusion alerts to an e-mail address of your choice.  In those cases, the programs send the necessary information only to the location(s) you've specified.

    Selecting certain program features, especially conversion of remote IP addresses to Names (URL's), may send your IP address to those remote locations (that's how the Internet works).  You don't have to use those features, and WallWatcher's "Help" explains how you can safeguard your address.

NOTE:  From time to time, some Anti-virus and Spyware detectors have indicated "False positives" on some of the WallWatcher components.  For example, Symantec's 9/15/2004 virus definitions caused Norton Anti-Virus (NAV) to warn that "wallwatcher.exe" versions 3.0.1022 (July 16, 2004) through 3.0.1200 (August 5, 2004) were Spyware.  That was a false positive, and Symantec corrected it a week later: the 9/22/2004 virus definitions accepted "wallwatcher.exe".


    There are two restrictions to the use of the WallWatcher programs: 1) you may not sell them, and 2) they are provided as-is, with no warranty or liability on the part of the developer.