topic TCPDUMP shows syslog traffic going to a specific destination - How to figure out what is sending it there? in General Topics

TCPDUMP shows syslog traffic going to a specific destination - How to figure out what is sending it there?

Art — Tue, 18 Feb 2014 20:02:11 GMT

I am hoping this is an "easy" question that I am just missing having been on calls since 4:24 am this morning :smileyconfused:

I have used tcpdump to confirm that one of our PAN firewalls are sending syslog traffic to a specific destination (w.x.y.z) which it is not supposed to. (we don't want it going to that 'collector' for band width reasons - we have a 'closer' collector.

Anyone have a trick to figure out what rule/construct is sending the syslog traffic to server w.x.y.z?

BlueCoat has a "Trace" functionality on their SG-OS that shows the evaluation by each rule as the traffic is evaluated ... that would be helpful... is there a similar thing in PAN-OS?

Thanks

Art

Re: TCPDUMP shows syslog traffic going to a specific destination - How to figure out what is sending it there?

Phoenix — Wed, 19 Feb 2014 14:31:48 GMT

Hello Art

If we look at the below image we see that the Traffic Log type has a field for "Rule" this would indicate the security rule name that is generating the log.

Hope this is exactly what is being looked for.

Re: TCPDUMP shows syslog traffic going to a specific destination - How to figure out what is sending it there?

Art — Mon, 24 Feb 2014 21:33:01 GMT

Thanks Phoenix... great idea... I will look into it... turned out there was one rule I hadn't noticed that was configured incorrectly that was routing the traffic.

thanks

Art