1

When looking at Traffic Monitor, you will see columns of numbers. However not all of them are apparent on what they are for. Unfortunately I don't have enough reputation to post images but I'll try to explain what I'm looking at.

Can someone let me know the following. Thanks.
1) What are the numbers on Column 7, 12, and 13?
2) What's the difference between what's shown on columns 6 and 8?

Column  Description
1   Date
2   Time
3   Shows "Allowed", Deny", etc
4   Source IP
5   Destination IP the Source IP is trying to target (ie Firebox's external IP for incoming traffic)
6   Protocol (Port name and sometimes Port number is shown also)
7   Unknown
8   Protocol (Port number but not sure difference from column 5 above)
9   Network from which Source IP originates from
10  Network to which Destination IP is at
11  Shows "Allowed", "blocked ports", etc
12  Unknown
13  Unknown
14  Policy name
3
  • Can you add a line or two of example rows from the traffic monitor?
    – Grant
    Oct 14, 2013 at 4:47
  • 2013-10-04 23:50:29 Deny 192.168.10.1 192.168.10.13 8000/tcp 4019 8000 0-External 0-Optional Bridge blocked ports 60 63 (Internal Policy) proc_id="firewall" rc="101" dst_ip_nat="192.168.60.4" tcp_info="offset 10 S 2698964068 win 5840" Traffic 2013-10-04 23:50:32 Deny 192.168.10.1 192.168.10.13 8000/tcp 4019 8000 0-External 0-Optional Bridge blocked ports 60 63 (Internal Policy) proc_id="firewall" rc="101" dst_ip_nat="192.168.60.4" tcp_info="offset 10 S 2698964068 win 5840" Traffic
    – user192702
    Oct 14, 2013 at 5:11
  • 2013-10-04 23:50:32 Allow 192.168.10.1 192.168.10.13 webcache/tcp 4135 8080 0-External 0-Optional Bridge Allowed 60 63 (TCP - NAS-00) proc_id="firewall" rc="100" dst_ip_nat="192.168.60.4" tcp_info="offset 10 S 2689599964 win 5840" Traffic 2013-10-04 23:50:32 Allow 192.168.10.1 192.168.10.13 rdp/tcp 3896 3389 0-External 0-Optional Bridge Allowed 60 63 (TCP - NAS-00) proc_id="firewall" rc="100" dst_ip_nat="192.168.60.4" tcp_info="offset 10 S 2702431472 win 5840" Traffic
    – user192702
    Oct 14, 2013 at 5:12

4 Answers 4

2

Guys I found the answer! On Firebox System Manager (the one where you use to look at Traffic Monitor), click on File -> Settings. Check the "Show Log Field Names" box and click OK. Here are the answers:

Date
Time
Permission (ie Allow, Deny, etc)
src_ip
dst_ip
pr (ie the looked up protocol such as ntp/udp, 8080/udp, 6699/udp, netbios-ns/udp, dns/udp, etc)
src_port
dst_port
src_intf
dst_intf
msg
pckt_len
ttl
policy (ie the policy you figured in the Policy Manager or an internal firebox policy)
proxy_action (I'm not seeing anything here but there's actually a column for this)
proc_id (Mine are showing "firewall")
rc (no idea what this is)
src_ip_nat
src_port_nat
0

Field 7 is probably the source port.

Not sure about the other two yet.

1
  • That's what I guessed too but I was looking for something more solid. Is there a table that describes these somwhere we can reference? Especially on columns 12 & 13.
    – user192702
    Oct 14, 2013 at 8:04
0

When within the Traffic Monitor if you would right click on a traffic entry you can edit the setting of Traffic Monitor. Within the Traffic Monitor setting it show the heading for each column.

They are:

Time - Disposition - Source IP - destination IP - protocol - source port - destination port - source interface - destination interface - message - packet length - time to live - policy - proxy action - repeat - details

0

From the source - check out the official documentation. Then remember to google and find this link.

http://www.watchguard.com/support/fireware_howto/HowTo_ReadFirewareLogs.pdf

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .