RE: [logs] Cisco PIX logs

From: Carroll, Shawn (SCarrollat_private)
Date: Fri Jan 31 2003 - 13:09:37 PST

  • Next message: Rainer Gerhards: "RE: [logs] Cisco PIX logs"

    Don't want to sound pedantic, but how are you sure the packet you captured is the same one that generated the log message?  What device/program did you do the capture with?
        | Shawn Carroll                       Network Infrastructure Group    |
        | Tel:     (802) 660-7812             ALLTEL Information Services     |
        | Email:   scarrollat_private    2 Burlington Sq.                |
        | Cell:    (802) 233-4037             Burlington, VT 05401            |
    -----Original Message-----
    From: Rainer Gerhards [mailto:rgerhardsat_private]
    Sent: Friday, January 31, 2003 1:00 PM
    To: loganalysisat_private
    Subject: [logs] Cisco PIX logs
    Hi all, 
    I am banging my head for some time now, so I think it is time to ask for assistance... I am sure I am overlooking the obvious, but I simply don't see it ;)
    As an example, I have those two log lines in my PIX log (a little sanitized, though). According to Cisco's message description ( this tells me that the local machine at initiates a connection (via NAT) to What makes me stumble are  the ports. In the message, I see my local machine using port 1071 and connecting to pt 5780 on the remote one. 
    2003-01-31,18:20:20,2003-01-31,18:20:20,,20,6,Jan 31 2003 17:12:41: %PIX-6-302005: Built UDP connection for faddr gaddr laddr
    2003-01-31,18:20:49,2003-01-31,18:20:49,,20,6,Jan 31 2003 17:13:10: %PIX-6-302006: Teardown UDP connection for faddr gaddr laddr
    So far, so good. When I look now at a packet capture taken on, I see that the source port is indeed 1071 but the destination is 53 (DNS). The same holds true for the packet coming back. I did not (yet) take a packet capture at the Internet side of the firewall.
    Any explanation for this? 
    LogAnalysis mailing list

    This archive was generated by hypermail 2b30 : Fri Jan 31 2003 - 15:26:12 PST