|
|
|
|
|
|
|
|
 |
 |
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] Re: [FW-1] [FW1] Sniffer | new firewall rule | help!
You need a database. I wrote some scripts to grab my nightly firewall logs and dump them into an oracle database. Here is the link to it on Phoneboy's site. http://www.phoneboy.com/fom-serve/cache/474.html It is set up for Oracle and FW-1 logs but could easily be ported to MySQL and any log format. Hope that helps. Jim Edwards -----Original Message----- From: Firewall Security [mailto:[email protected]] Sent: Tuesday, April 15, 2003 6:41 AM To: [email protected] Subject: [FW-1] [FW1] Sniffer | new firewall rule | help! This question is a bit off topic, but will be used to build new firewall rules: Here's the goal: identify connections to a particular server. This info will be used to form access controls and security measures. (aka new firewall rules) The info derived is from a weeks worth of sniffer basic logs*, I'm mainly concerned about: 1. source IP 2. destination IP 3. protocol 4. time 5. packet size I've used excel to sort the data, but I end up going through 15,000 plus excel rows trying to find different IPs, there has to be a quicker, more efficient way. Unfortunately this is time sensitive, so I can't redo sniffing process. Ideas? *sniffer was attached to the same switch, via mirrored port looking for traffic to this server (by IP) Muchos Gracias ================================================= To set vacation, Out Of Office, or away messages, send an email to [email protected] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [email protected] ================================================= ================================================= To set vacation, Out Of Office, or away messages, send an email to [email protected] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [email protected] =================================================
|
||||||||||
 |
 |
 |
 |
 |
 |
 |
 |
 |
|
