Penetration Testing mailing list archives
RE: Data Mining for PIX Firewall Logs
From: mhuston () imagitekltd com
Date: Thu, 10 Feb 2005 09:27:33 -0600
Welcome to the kludge. I use a *nix syslog server to log the connections and then pipe that output to fwanalog. Not very fast or pretty for managerial consumption, but it will at least give you a start in the right direction. Free as well, http://tud.at/programm/fwanalog/ cheers, M -----Original Message----- From: Carey Heck [mailto:carey.heck () gmail com] Sent: Wednesday, February 09, 2005 4:09 PM To: pen-test () securityfocus com; bugtraq () securityfocus com Subject: Data Mining for PIX Firewall Logs Hi folks. I love the ability in the Checkpoint firewall logging applet that allows me to load up any former saved log file, and filter according to any criteria I set. Lets use an example: I want to show an auditor what exactly went through my firewall, to/from a specific DMZ host, between the hours of 1 and 3pm GMT, on July 8th, 2003. In checkpoint, if I had correctly configured my ruleset, and archived my log files properly, I could provide this answer within 30 minutes. Fast forward to my current company, which went with a Cisco PIX solution based on the up front cost. I can log all the connections to my heart content, but boy mining the data to help show what happened in my above example has been tiresome at best. Can anyone here please suggest to me some type of logging and more relevantly, a data mining product that can help me achieve this end? Currently I am logging all my PIX traffic to a host running Kiwi syslog daemon, which archives each days logs into a separate folder in the dated logs directory, creating a new directory named for each date in the year. I am looking for a less clunky solution. Any help is GREATLY appreciated. Thanks! -- Carey
Current thread:
- Data Mining for PIX Firewall Logs Carey Heck (Feb 09)
- Re: Data Mining for PIX Firewall Logs jkowall (Feb 11)
- RE: Data Mining for PIX Firewall Logs Jerry Shenk (Feb 11)
- RE: Data Mining for PIX Firewall Logs Carey Heck (Feb 11)
- Re: Data Mining for PIX Firewall Logs Michael J McCafferty (Feb 11)
- Message not available
- Re: Data Mining for PIX Firewall Logs Michael J McCafferty (Feb 21)
- Message not available
- <Possible follow-ups>
- Re: Data Mining for PIX Firewall Logs Cesar Diaz (Feb 11)
- RE: Data Mining for PIX Firewall Logs mhuston (Feb 11)
- Re: Data Mining for PIX Firewall Logs dijit (Feb 11)
- RE: Data Mining for PIX Firewall Logs Todd Towles (Feb 11)
- RE: Data Mining for PIX Firewall Logs Hill, Keith (Contractor) (Feb 11)