Question

What kind of information is collected in a firewall log? How would this information be used in a network forensics investigation?

Answer 1

Firewall Systems have a Log Tab. It has real time up to date, integrated data of traffic logs generated by firewall system. It is in form of a table.

It may have following fields:

Time : exact time of an event occuring.

Direction : incoming or outgoing traffic

Action : action taken by firewall, namely block, allow, ask and disconnect.

Protocol : type of protocol such as UDP, TCP, ICMP etc used by the specific connection

SRC address : IP address of incoming packet.

SRC host : resolving ID of incoming packet system.

SRC port : port from which incoming packet left.

DST address : outgoing packet destination IP address.

DST host : outgoing packet destination system ID.

DST port : outgoing packet destination port address where packet will be accepted.

Process : The .exe file to which incoming or outgoing packet belongs.

SRC MAC : MAC address of sender system.(Remote)

DST MAC : MAC address of sending system.

Use of Firewall Logs in Network Forensics:

1. Analyse port with which no application or service is connected. Hackers may use backdoor trojans through these.

2. IP addresses refused or dropped can be checked for illegal port access.

3. Looking for unsuccessful access to system firewall.