How to collect KES11 traffic dump [KES for Windows]

[Antipova Anna]

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials.

This instruction is relevant only in case of troubleshooting incorrect loading or rendering of a web page.

In order to troubleshoot issues KES network traffic related issues traffic dump is required. It is easier to analyze and does not require third-party software installation. 

If reproduction of the issue requires the web browser to open web pages(such as web control non-working as expected, web page not loading, and so on), the tests should be performed in Incognito mode(also known as private browsing).

Chrome browser: Ctrl+Shift+N or you can start browser from terminal: & "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -incognito . Starting application from terminal will make launch key visible in traces and make diagnostic easier.

Firefox browser: Ctrl+Shift+P or you can start browser from terminal: & "C:\Program Files\Mozilla Firefox\firefox.exe" -private-window . Starting application from terminal will make launch key visible in traces and make diagnostic easier.

Microsoft Edge: Ctrl+Shift+P

Opera browser: Ctrl+Shift+N

KES11 Instructions

1. Disable KES11 Self-defense

2. Navigate to the following registry key:

   x86: HKLM\SOFTWARE\KasperskyLab\protected\KES\environment\ x64: HKLM\SOFTWARE\Wow6432Node\KasperskyLab\protected\KES\environment\

3. Create a string type value named DumpNetworkTraffic :

   DumpNetworkTraffic = (REG_SZ)"1"

4. Restart the product or reboot the host
5. Traffic dump files will be saved to %ProgramData%\Kaspersky Lab\KES\Data\traffic
6. Once the issue is reproduced compress the whole traffic directory
    

Do not forget to disable traffic dump collection. To do so delete DumpNetworkTraffic value.