Unit 9: Firewalls and segmentation · Lesson 2 of 6 · 18 min
Reading drop logs
Search web01's firewall drop log for the noisiest sources and the one internal address that does not belong.
mission
- You are
- The analyst writing the weekly firewall report.
- Situation
- Every packet the input chain drops is logged with its source, destination and port. Most of it is internet noise. Some of it is not.
- Goal
- Find the top scanner, the most targeted port and any internal source in the drop log.
- Hand in
- The top source, the top port and the internal address with its target port.
One drop log line
- 1
Oct 14 14:00:09time - 2
SRC=203.0.113.50who sent it - 3
PROTO=TCPtransport - 4
DPT=25the door it knocked on
Count one scanner
Search for SRC=203.0.113.50, the scanner from earlier units. The counter shows its drops.
you should see 167 of 423 events.
Count the popular ports
Search DPT=23, then DPT=445. Telnet and file sharing are what internet scanners hunt for most.
you should see Port 23 is the most knocked-on door in the log.
defender tip A busy port in the drop log is fine: the firewall did its job. A busy port that is missing from the drop log may be one you are accepting by mistake.
Find the insider
Search SRC=10.. Internet scanners are expected; an office machine knocking on a server port is not.
you should see Three drops from an office laptop to one port, seconds apart.
defender tip Three tries a few seconds apart is a TCP client retrying a SYN that got no answer. It ties back to the filtered port you found in the TCP unit.
Repeat the counts on the machine
The same counts with grep, for the report.
grep -o 'SRC=[0-9.]*' fw.log | sort | uniq -c | sort -rn 167 SRC=203.0.113.50 88 SRC=198.51.100.23 87 SRC=192.0.2.144 78 SRC=203.0.113.201 3 SRC=10.10.0.44 grep -o 'DPT=[0-9]*' fw.log | sort | uniq -c | sort -rn | head -n 3 131 DPT=23 82 DPT=445 40 DPT=161
What a defender takes away
- 1Drop logs show what was refused; count by source and by port.
- 2Internal sources in a perimeter drop log are leads, not noise.
- 3Ports you accept never appear in a drop log, so absence is worth checking too.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.