Allied Telesis AR Series Technical Manual page 73

Logging
New connection log messages includes information in the following format for a newly started
firewall connection:
NEW proto={tcp|udp|icmp|...|<number>} orig_src={<ipv4-addr>|<ipv6-addr>}
orig_dst={<ipv4-addr>|<ipv6-addr>} [orig_sport=<source-port>]
[orig_dport=<dest-port>] reply_src={<ipv4-addr>|<ipv6-addr>}
reply_dst={<ipv4-addr>|<ipv6-addr>} reply_sport=<source-port>
reply_dport=<dest-port>
Closed connection log messages includes information in the following format for a firewall
connection that has ended:
END proto=[tcp|udp|icmp|...|<protocol-number>] orig_src={<ipv4-addr>|
<ipv6-addr>} orig_dst={<ipv4-addr>|<ipv6-addr>} [orig_sport=<source-port>]
[orig_dport=<dest-port>] orig_pkts=<packets> orig_bytes=<bytes>
reply_src={<ipv4-addr>|<ipv6-addr>} reply_dst={<ipv4-addr>|<ipv6-addr>}
reply_sport=<source-port> reply_dport=<dest-port> reply_pkts=<number>
reply_bytes=<number>
Table 12: Elements in firewall connection log messages
Message elements
proto={tcp|udp|icmp|<protocol>|
<number>}
orig_src={<ipv4-addr>|<ipv6-addr>}
orig_dst={<ipv4-addr>|<ipv6-addr>}
orig_sport=<source-port>
orig_dport=<dest-port>
orig_pkts=<packets>
orig_bytes=<bytes>
reply_src={<ipv4-addr>|<ipv6-addr>
reply_dst={<ipv4-addr>|<ipv6-addr>
reply_sport=<source-port>
reply_dport=<dest-port>
reply_pkts=<number>
reply_bytes=<number>
Note that the original source and destination addresses and ports may differ from the reply source
address and destination addresses and ports depending on whether NAT is applied and the type of
NAT.
C613-22104-00 REV B
Description
The protocol or protocol number for the connection.
The source IPv4 or IPv6 address of the packet originating
the connection.
The destination IPv4 or IPv6 address for the packet
originating the connection.
The source port number of the originating packet.
The destination port number of the originating packet.
The total number of packets passed in the originating
direction.
The total number of bytes passed in the originating
direction.
The source IPv4 or IPv6 address of the returning packets.
The destination IPv4 or IPv6 address of the returning
packets.
The source port number of the returning packets.
The destination port number of the returning packets.
The total number of returning packets.
The total number of returning bytes.
Firewall Connection Logging
Advanced Network Protection
|
Page 73