User`s guide

389
----- 5-10-2009 23:12:08 ------
FW LOG Dir: IN Line: 37 Hits: 4730 IFACE: ETH 3
Source IP: 222.45.112.59 Dest IP: 217.34.133.21 ID: 256 TTL: 106 PROTO: TCP (6)
Src Port: 12200 Dst Port: 8118
block log break end
----------
----- 5-10-2009 23:13:15 ------
FW LOG Dir: IN Line: 37 Hits: 4731 IFACE: ETH 3
Source IP: 218.61.22.42 Dest IP: 217.34.133.21 ID: 35372 TTL: 136 PROTO: TCP (6)
Src Port: FTP CTL (21) Dst Port: 16794
block log break end
----------
2 example logged packets are shown. The output of the 1st logged packet can be explained
as follows:
----- 5-10-2009 23:12:08 ------
This is the time stamp of the blocked packet.
FW LOG Dir: IN Line: 37 Hits: 4730 IFACE: ETH 3
‘Dir:’ is the direction of the packet that was logged, either IN or OUT of the router.
‘Line:’ is the line number within the firewall rules that caused this packet to be logged.
‘Hits:’ is the number of packets that have matched this rule.
‘IFACE:’ is the interface which the packet was logged on.
Source IP: 222.45.112.59 Dest IP: 217.34.133.21 ID: 256 TTL: 106 PROTO: TCP (6)
‘Source IP:’ is the source IP address of the packet that was logged.
‘Dest IP:’ is the destination IP address of the packet that was logged.
‘ID:’ is the ID of the packet, this is taken from the packet header.
‘TTL:’ is the Time To Live value.
‘PROTO:’ is the layer 3 protocol of the logged packet.
Src Port: 12200 Dst Port: 8118
‘Src Port’ is the source TCP or UDP port number of the packet that was logged.
‘Dst Port’ is the destination TCP or UDP port number of the packet that was logged.
‘block log break end’ This is the actual rule that caused the packet to be logged.
Related CLI Commands
Command
Options
Equivalent Web Parameter
type fwlog.txt n/a Displays the current Firewall trace.