RE: [fw-wiz] parsing logs ultra-fast inline





Anton Chuvakin wrote:

While I am preparing to enter this discussion in full force :-), I
figured I'd shoot a quick one on this:

meaning. Take Tina's VPN example - how many types of log entries you
would expect from a VPN concentrator? From my experience, not more
than 20 but let's assume there are 50. Give a sample from each entry
to a Perl

He-he, no :-) I just looked at the old documentation bundle of Cisco
VPN 3000 messages and its nowhere near the above. How about 2049
unique messages documented by Cisco?

But don't miss my point! I don't have to parse all those 2k or more
messages, because I'm only after *one* thing: all I want to know (at least
starting out) is the source of an inbound remote access connection, because
my pick for lowest-hanging-fruit with regard to remote access abuse is
remote access coming from "unusual" locations.

In fact, the discussion is trying really hard to support the exact opposite
of what I was saying :-) If you start out trying to parse *everything*,
you're at best going to work really really hard for a long time. If you pick
one or two conditions that you or your local expert *know* are significant,
you get something up and running really quickly. That impresses management
:-)

cheers - tbird

_______________________________________________
firewall-wizards mailing list
firewall-wizards@xxxxxxxxxxxxxxxxxx
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards



Relevant Pages

  • Re: [fw-wiz] parsing logs ultra-fast inline
    ... While I am preparing to enter this discussion in full force :-), ... figured I'd shoot a quick one on this: ... expect from a VPN concentrator? ... no :-) I just looked at the old documentation bundle of Cisco ...
    (Firewall-Wizards)
  • Re: vpnc on FreeBSD 6.2
    ... I am trying to make vpnc working on my FreeBSD 6.2 laptop to connect to a Cisco ... 3000 VPN concentrator without any luck. ... I just recently colaborated with a co-worker in getting vpnc working on our non-Windoes machines. ...
    (freebsd-questions)
  • Re: Cisco Secure ACS vs. Firewall
    ... Good points about the Cisco 3000 VPN Concentrator. ... mentioning about the *firewall* is that the VPN3K does basic NAT/Port ... RE>>on the company LAN is. ...
    (Security-Basics)
  • 3005 VPN does not respond on console port
    ... I have a CISCO 3005 VPN Concentrator that came back from a site we shut ... I have no passwords for this device. ... blinking cursor. ...
    (comp.dcom.vpn)
  • Re: Alternative for cisco vpn concentrator
    ... Even though Cisco has discontinued the VPN concentrator series, ... model devices. ...
    (comp.dcom.sys.cisco)