topic monitor range of ip traffic in General Topics

monitor range of ip traffic

bdapice — Tue, 24 Jun 2014 15:23:34 GMT

Does anyone know how to monitor a range of IP traffic on the firewall? Note: i'm trying to view the historical traffic data on the firewall as it's not pertinent to set up a new rule and monitor all traffic to/from the range requested of me.

i'm currently running version 10.0.5 on a PA3020 and i've been requested to check for any traffic from a range of IP addresses (ex: 120.50.47.20 - 120.50.47.30). Some of the ranges requested to monitor are quite large so it's going to be painful to go through each IP address in each range so i'm looking for a faster way of check this historical data.

any assistance is appreciated.

thank you,

-Brandon

Re: monitor range of ip traffic

Mystique — Tue, 24 Jun 2014 16:09:56 GMT

You can use filter as ( addr in 120.50.47.0/24) under Monitor --> Logs --> Traffic

Hope this helps.

Re: monitor range of ip traffic

bdapice — Tue, 24 Jun 2014 16:38:22 GMT

Thank you. That helps. (This will work for me but I was hoping it would filter out the additional addresses within the subnet that aren't needed in my research.)

(This company request is a wild goose chase that they have me on and there's nothing like a wild goose chase to waste a day.)

Re: monitor range of ip traffic

Mystique — Tue, 24 Jun 2014 17:14:12 GMT

You can use this filter (addr notin 'ip address') to filter out the additional addresses in addition to the above subnet filter ( addr in 120.50.47.0/24)

For e.g. ( addr in 120.50.47.0/24) and (addr notin '120.50.47.1') or you can use more subnet specific filters for e.g. just for range ex: 120.50.47.20 - 120.50.47.30, the filter will look like ( addr in 120.50.47.20/28)