Log Types: NetgearRouterLog
- Leigh Purdie (Unlicensed)
Overview
Netgear Routers include stateful packet filtering and access control features.
Collection
The Snare Central server can receive events from Netgear routers via syslog.
Sample Events
TCP Packet - Source:4.79.142.206,65133 Destination:150.101.115.22,389 - [ANY rule match]TCP Packet - Source:6.108.124.122,2782 Destination:90.194.xxx.xxx,59073 - [DOS]TCP packet dropped - Source:64.12.47.28,4787,WAN - Destination:134.177.0.11,21,LAN - [Inbound Default rule match]UDP packet dropped - Source:64.12.47.28,10714,WAN - Destination:134.177.0.11,6970,LAN - [Inbound Default rule match]ICMP packet dropped - Source:64.12.47.28,0,WAN - Destination:134.177.0.11,0,LAN - [Inbound Default rule match]
Fields
Field | Description |
|---|---|
DATE | Event date, in the format YYYY-MM-DD |
TIME | Event time, in the format HH:MM:SS |
SYSTEM | The source system |
TABLE | NetgearRouterLog |
ACTION | Actions such as dropped |
SRCADDR | Source IP address |
SRCPORT | Source port |
DSTADDR | Destination IP address |
DSTPORT | Destination port |
PROTO | Protocol |
MESSAGE | The remainder of the log message |
Notes
Â
Â