How to collect KES11 traffic dump [KES for Windows]

[Antipova Anna]

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials.

This instruction is relevant only in case of troubleshooting incorrect loading or rendering of a web page.

In order to troubleshoot issues KES network traffic related issues traffic dump is required. It is easier to analyze and does not require third-party software installation. 

If reproduction of the issue requires the web browser to open web pages(such as web control non-working as expected, web page not loading, and so on), the tests should be performed in Incognito mode(also known as private browsing).

Chrome browser: Ctrl+Shift+N or you can start browser from terminal: & "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -incognito . Starting application from terminal will make launch key visible in traces and make diagnostic easier.

Firefox browser: Ctrl+Shift+P or you can start browser from terminal: & "C:\Program Files\Mozilla Firefox\firefox.exe" -private-window . Starting application from terminal will make launch key visible in traces and make diagnostic easier.

Microsoft Edge: Ctrl+Shift+P

Opera browser: Ctrl+Shift+N

 

KES11/12 Instructions

1. Disable KES11/12 Self-defense

2. Navigate to the following registry key:

   x86: HKLM\SOFTWARE\KasperskyLab\protected\KES<Build version>\environment\ x64: HKLM\SOFTWARE\Wow6432Node\KasperskyLab\protected\KES<Build version>\environment\

3. Create a string type value named DumpNetworkTraffic :

   DumpNetworkTraffic = (REG_SZ)"1"

4. Restart the product or reboot the host
5. Traffic dump files will be saved to %ProgramData%\Kaspersky Lab\KES<Build version>\Data\traffic
6. Once the issue is reproduced compress the whole traffic directory
    

Do not forget to disable traffic dump collection. To do so delete DumpNetworkTraffic value.Then restart the product or reboot the host.