[Dshield] reporting on firewall logs
David Cary Hart
DavidHart at TQMcube.com
Wed Oct 27 01:07:02 GMT 2004
On Tue, 2004-10-26 at 13:07, shawn reed wrote:
> Redhat 9. Using gawk to extract and sort the logs.
>From Netfilter Patch-o-matic, install ulog (which substitutes for the
LOG target). Follow the instructions to input the ULOG output to a MySQL
db. The DB is updated in real time. Make sure that you set ULOG to batch
- print and store - 25 to 50 records at a time. This will save lots of
Once you have the data in a db you can do whatever you want with them.
MySql has the necessary built-ins to convert unix to human time and
binary IPs to octets.
> On Tue, 2004-10-26 at 10:57, shawn reed wrote:
> > I'd like to get some feedback/expertise on the process that I am using for reporting on firewall logs. Would this acurately reflect the profile of traffic through the firewall?
> OS? DShield Client?
> > 1. Extract the following fields: date, time, action, protocol, src IP, dst IP, src port, src address.
> > 2. Divide log into three categories based on the direction of the traffic: incoming, outgoing, internal.
> > (This is done by using a list of internal IP blocks and pulling out the lines of the log based on the src and dst IP.
> > i.e.
> > src 10.10.1.20, dst external_ip >outgoing.log
> > src external_ip, dst 10.10.1.20 >incoming.log
> > src 10.10.1.20, dst 10.10.1.50 >internal.log
> > 3. Create reports from the three categories of log files: incoming, outgoing, internal.
> Do you Yahoo!?
> Yahoo! Mail - You care about security. So do we.
> DShield and the Internet Storm Center are sponsored by the SANS Institute.
> To learn more about current SANS training, see http://www.sans.org .
> send all posts to list at lists.dshield.org
> To change your subscription options (or unsubscribe), see: http://www.dshield.org/mailman/listinfo/list
David Cary Hart
Hart's PGP key:
More information about the list