How to use the ISA firewall monitoring function (graphic tutorial)

Recently, the server has been attacked and traffic has soared. I want to check the usage of ISA Server. I need to enable monitoring. How can I use the monitoring function in the ISA Server firewall? If it is a LAN computer attack server, you can consider deploying a dedicated LAN network access control system. For example, there is a “Large-to-Network Access Control System” (download address: http://www.grablan.com/wailaidiannaokongzhi.html), which only needs to be deployed on a LAN computer to prevent LAN computers from accessing the server. It is forbidden to communicate with LAN computers and detect LAN ARP attacks. Once a computer attack server is found, it can directly block the communication between the computer and the server, thus preventing its attack behavior. In addition, the system can also prevent external computers from randomly accessing the LAN, prohibiting LAN computers from changing IP addresses or MAC addresses, detecting the use of LAN wireless routers, and prohibiting LAN network sniffing, etc., to fully protect LAN network security. As shown below:
In the firewall system based on ISA Server server and Microsoft firewall client, monitoring system and network activities is very easy. Users can use the “Monitoring” node in the ISA Server server management window to learn about the session between the ISA server and the firewall client, the service operation of the ISA server, and the connectivity check. The log can be used to query the client in real time. Network activity. Open the ISA Server Management window and click on the "Dashboard" tab in the right pane. In the "Dashboard" tab, you can clearly see the current system and network operation of the ISA Server server. In the "session" tab, you can see the client computer information currently communicating with the ISA Server server, as shown. The Dashboard tab allows you to know the network activity status of the firewall client through the log function. Users can specify the log query conditions by editing the filter. The operation steps are as follows: Step 1, open the ISA Server server management window, and “Monitor” & rdquo; Under the node switch to the "Logs" tab, and click the "Edit Filter" hyperlink as shown. Click “Edit Filter> Hyperlink Step 2, open the “Edit Filter” dialog box, select the “Client IP” option in the “Filter by” drop-down menu, and then in the “conditions” In the <quo; drop-down menu, select the “equalize” option, and enter the target firewall client IP address 10.115.223.198 in the “value" edit box, and finally click the “Add to list” button. Then select the filter condition you just created in the list of items that only meet these criteria, and click the “Start Query” button as shown. Click the “Start Query” button to return to the Manager window. In the “Log” tab, you can get the current network activity information of the Firewall Client in real time, as shown in the figure. “Log” tab