Log Management · Topic 3 of 5
Firewall and Router Logs
Learn firewall log fields, Windows Firewall, iptables and Cisco ASA and IOS log messages, and the patterns that reveal scans and attacks for CSA 312-39.
- 5 min
- Key firewall fields: time, action, protocol, source and destination IP and port, rule ID and bytes.
- Many ports on one host is a vertical scan. One port on many hosts is a horizontal sweep.
- Cisco format is
%FACILITY-SEVERITY-MNEMONIC, and severity uses the 0 to 7 syslog scale.
What it is
Firewall logs record traffic the firewall allowed or denied, with addresses, ports and the rule that matched. Router logs record device events: interface changes, access list hits, logins and configuration changes.
Together they show who talked to whom across the network edge and inside it. They are where scans, blocked attacks, C2 traffic and tampering with network devices first appear.
How it works
Common firewall log fields
| Field | Why it matters |
|---|---|
| Date and time | Builds the timeline, needs NTP |
| Action | Allow, deny or drop |
| Protocol | TCP, UDP, ICMP |
| Source IP and port | Who started the connection |
| Destination IP and port | The target host and service |
| Rule or policy ID | Which rule matched |
| Interface or zone | Inside, outside or DMZ |
| Bytes and duration | Volume, useful for spotting exfiltration |
| NAT addresses | Maps public addresses back to internal hosts |
Windows Defender Firewall log
Windows Defender Firewall can write a text log, by default to %windir%\system32\LogFiles\Firewall\pfirewall.log. Logging of dropped packets and successful connections is turned off by default and must be enabled per profile.
Each line holds fields such as date, time, action (ALLOW or DROP), protocol, src-ip, dst-ip, src-port, dst-port and size. A line described in words: "a DROP of a TCP packet from 203.0.113.50 port 51515 to this host on port 3389" means an RDP attempt was blocked.
Linux iptables logs
When a rule uses the LOG target, the kernel writes a message to the kernel log or syslog. The entry contains key value fields such as IN=, OUT=, SRC=, DST=, PROTO=, SPT= and DPT=. A log prefix set in the rule, such as "DROP INPUT", tells the analyst which rule fired.
Cisco ASA messages
Cisco devices tag each syslog message with %FACILITY-SEVERITY-MNEMONIC, using the same 0 to 7 severity scale as syslog.
| Message | Meaning |
|---|---|
%ASA-6-302013 | Built a TCP connection |
%ASA-6-302014 | Teardown of a TCP connection, with duration and bytes |
%ASA-4-106023 | Deny by access group, the packet matched a deny rule in an ACL |
The connection built and teardown pair lets an analyst measure how long a session lasted and how much data moved.
Router logs (Cisco IOS)
| Message | Meaning |
|---|---|
%SEC-6-IPACCESSLOGP | A packet matched an access list entry with the log keyword, permitted or denied |
%SYS-5-CONFIG_I | The configuration was changed, with the user and source |
%LINK-3-UPDOWN | An interface changed state |
%LINEPROTO-5-UPDOWN | The line protocol on an interface changed state |
%SEC_LOGIN-4-LOGIN_FAILED | A login to the device failed |
%SEC_LOGIN-5-LOGIN_SUCCESS | A login to the device succeeded |
Cisco severity keywords match syslog levels: emergencies (0), alerts (1), critical (2), errors (3), warnings (4), notifications (5), informational (6) and debugging (7).
Patterns to recognize
| Pattern in the logs | Likely meaning |
|---|---|
| One source, many destination ports on one host, mostly denied | Port scan (vertical scan) |
| One source, the same port on many hosts | Host sweep (horizontal scan) for a service |
| Many sources, one destination, very high volume | DDoS |
| Internal host, regular outbound connections to one external IP | C2 beaconing |
| Internal host sending a large volume out, often at night | Possible data exfiltration |
| Outbound traffic on unusual ports, or DNS to servers other than the internal resolvers | Policy bypass or tunneling |
| Denied traffic from an internal host to many internal hosts on 445 or 3389 | Worm or lateral movement |
| Router login failures followed by a success and a config change | Device compromise |
| Logging stopped or the ACL changed without a change ticket | Tampering |
A worked example
The edge firewall shows %ASA-4-106023 denies from one internet address to hundreds of closed ports on the web server over 90 seconds. Twenty minutes later the same address has a %ASA-6-302013 built connection to port 443, which is allowed, and a teardown entry showing 2 GB sent from the server to that address.
The scan was blocked, but the allowed HTTPS session moved an unusual amount of data out. The analyst escalates a possible web server compromise and exfiltration, and checks the web server logs for the same address and time.
How the exam asks about this
- "Firewall logs show one internal host trying port 445 on hundreds of internal hosts. What is the most likely cause?" → A worm or lateral movement over SMB.
- "Which Cisco IOS message shows the running configuration was changed?" →
%SYS-5-CONFIG_I. - "In a Cisco message
%ASA-4-106023, what does the 4 mean?" → The severity level, warning.
What to remember for the exam
- Key firewall fields: time, action, protocol, source and destination IP and port, rule ID and bytes.
- Many ports on one host is a vertical scan. One port on many hosts is a horizontal sweep.
- Cisco format is
%FACILITY-SEVERITY-MNEMONIC, and severity uses the 0 to 7 syslog scale. - Built and teardown messages show session duration and data volume.
- Router config changes and logins must be logged and matched to change tickets.
Do not read only the denies. A blocked scan followed by an allowed connection from the same source is the entry that matters.
Common mistakes
Treating denied traffic as harmless. Denies show intent and reconnaissance. The next allowed connection from that source deserves attention.
Ignoring outbound logs. Exfiltration and C2 are outbound. Some firewall policies log only inbound or denied traffic unless configured otherwise.
Forgetting NAT. The public address in an edge log may stand for many internal hosts. Use the NAT fields or translation logs to find the real host.
Check yourself
Where does Windows Defender Firewall write its log by default?
To
%windir%\system32\LogFiles\Firewall\pfirewall.log, once logging is enabled for the profile.What do
SRC=andDPT=show in an iptables log entry?The source IP address and the destination port of the logged packet.
What does a router login failure followed by a success and
%SYS-5-CONFIG_Isuggest?A possible password guessing attack that succeeded and was followed by a configuration change.
Topic 3 of 5 in Log Management
Test yourself on Log Management
The full EC-Council 312-39 question bank has 700 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.