Use this tool to analyze and troubleshoot firewall connectivity issues by monitoring the ISA Server kernel-mode driver (fweng.sys). A set of command line options provide a way of looking at low-level driver activity, at a specific point in time. View connection and creation elements, open and close firewall access for a specified IP address range, print information about specific connection elements, and filter lists. Export output to an XML file.

FwEngMon.exe provides a way of looking at some of the elements of the kernel-mode driver, to help you understand what’s going on at the low-level drivers, at a specific time. The first part of the document describes how to use the tool. In the section Useful Information, you can read more about kernel-mode driver elements.