[logs] Cisco PIX logs

From: Rainer Gerhards (rgerhardsat_private)
Date: Fri Jan 31 2003 - 09:59:42 PST

  • Next message: Jeremy Mates: "[logs] Re: sql-worm and the address generator"

    Hi all,
    I am banging my head for some time now, so I think it is time to ask for
    assistance... I am sure I am overlooking the obvious, but I simply don't
    see it ;)
    As an example, I have those two log lines in my PIX log (a little
    sanitized, though). According to Cisco's message description
    g/pixemsgs.htm#xtocid5) this tells me that the local machine at initiates a connection (via NAT) to What makes
    me stumble are  the ports. In the message, I see my local machine using
    port 1071 and connecting to pt 5780 on the remote one. 
    2003-01-31,18:20:20,2003-01-31,18:20:20,,20,6,Jan 31 2003
    17:12:41: %PIX-6-302005: Built UDP connection for faddr gaddr laddr
    2003-01-31,18:20:49,2003-01-31,18:20:49,,20,6,Jan 31 2003
    17:13:10: %PIX-6-302006: Teardown UDP connection for faddr gaddr laddr
    So far, so good. When I look now at a packet capture taken on, I see that the source port is indeed 1071 but the
    destination is 53 (DNS). The same holds true for the packet coming back.
    I did not (yet) take a packet capture at the Internet side of the
    Any explanation for this?
    LogAnalysis mailing list

    This archive was generated by hypermail 2b30 : Fri Jan 31 2003 - 11:47:58 PST