Log Types: IPTablesFirewall

Owned by Leigh Purdie (Unlicensed)
Sept 16, 2020
2 min read

Overview

IPTables is a user-space utility program that allows a system administrator to configure the IP packet filter rules of the Linux kernel firewall.

Collection

IPTables Firewall logs are generally either forward to the Snare Central server via syslog, or an epilog agent is used to monitor and collect events from the raw firewall log files stored in /var/log

Sample Events

Aug 10 13:57:29 bilbo kernel: [769425.505084] [UFW BLOCK] IN=eth0 OUT= MAC=00:50:56:9a:00:a0:a8:d0:e5:51:ce:61:08:00 SRC=112.208.232.17 DST=175.107.146.58 LEN=69 TOS=0x00 PREC=0x00 TTL=48 ID=53587 DF PROTO=UDP SPT=38642 DPT=38978 LEN=49
Aug 10 13:53:41 bilbo kernel: [769196.755750] [UFW BLOCK] IN=eth0 OUT= MAC=00:50:56:9a:00:a0:a8:d0:e5:51:ce:61:08:00 SRC=79.123.67.172 DST=175.107.146.59 LEN=60 TOS=0x00 PREC=0x00 TTL=51 ID=55139 DF PROTO=TCP SPT=37676 DPT=88 WINDOW=5840 RES=0x00 SYN URGP=0
Aug 10 13:53:38 bilbo kernel: [769193.758649] [UFW BLOCK] IN=eth0 OUT= MAC=00:50:56:9a:00:a0:a8:d0:e5:51:ce:61:08:00 SRC=79.123.67.172 DST=175.107.146.59 LEN=60 TOS=0x00 PREC=0x00 TTL=51 ID=55138 DF PROTO=TCP SPT=37676 DPT=88 WINDOW=5840 RES=0x00 SYN URGP=0
Aug 10 13:51:27 bilbo kernel: [769062.928774] [UFW BLOCK] IN=eth0 OUT= MAC=00:50:56:9a:00:a0:a8:d0:e5:51:ce:61:08:00 SRC=88.248.245.246 DST=175.107.146.59 LEN=69 TOS=0x00 PREC=0x00 TTL=43 ID=25694 DF PROTO=UDP SPT=33755 DPT=38978 LEN=49
Aug 10 13:51:27 bilbo kernel: IN=ppp0 OUT= MAC= SRC=66.102.9.104 DST=203.122.220.71 LEN=40 TOS=0x00 PREC=0x00 TTL=235 ID=22327 PROTO=TCP SPT=80 DPT=1426 WINDOW=9300 RES=0x00 RST URGP=0
Aug 10 13:51:27 bilbo kernel: IN=ppp0 OUT= MAC= SRC=203.122.80.57 DST=203.122.220.71 LEN=48 TOS=0x00 PREC=0x00 TTL=116 ID=52121 PROTO=TCP SPT=1470 DPT=445 WINDOW=8760 RES=0x00 SYN URGP=0

Fields

Field

Description

Field

Description

DATE

Event date, in the format YYYY-MM-DD

TIME

Event time, in the format HH:MM:SS

SYSTEM

The source system

TABLE

IPTablesFirewall

ACTION

The action taken by the firewall when this packet was received

INTERFACE

The physical or virtual network interface

SRCADDR

Source IP address

SRCPORT

Source port

DSTADDR

Destination IP address

DSTPORT

Destination port

PROTO

Protocol

STRINGS

Any other content that does not fit into other predefined fields

Notes

-